{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/7044","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7044/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7044/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7044/events","html_url":"https://github.com/joomla/joomla-cms/issues/7044","id":81161975,"number":7044,"title":"Usage of cookies in plugin language filter","user":{"login":"andrepereiradasilva","id":9630530,"avatar_url":"https://avatars.githubusercontent.com/u/9630530?v=3","gravatar_id":"","url":"https://api.github.com/users/andrepereiradasilva","html_url":"https://github.com/andrepereiradasilva","followers_url":"https://api.github.com/users/andrepereiradasilva/followers","following_url":"https://api.github.com/users/andrepereiradasilva/following{/other_user}","gists_url":"https://api.github.com/users/andrepereiradasilva/gists{/gist_id}","starred_url":"https://api.github.com/users/andrepereiradasilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrepereiradasilva/subscriptions","organizations_url":"https://api.github.com/users/andrepereiradasilva/orgs","repos_url":"https://api.github.com/users/andrepereiradasilva/repos","events_url":"https://api.github.com/users/andrepereiradasilva/events{/privacy}","received_events_url":"https://api.github.com/users/andrepereiradasilva/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-26T22:19:01Z","updated_at":"2015-05-27T07:46:00Z","closed_at":null,"body":"### Issue\r\nThe language filter plugin uses cookies to save the user selected language. Two things to consider:\r\n1. In an HTTPS only site shouldn't the language cookie be Secure and HTTP only?\r\n2. What if the website admin doesn't want to use the language cookie, for instance, because of caching servers, since HTTP pages with cookies (especilly with hashes) can be very hard to configure in caching servers. How can the language cookie be disabled and only be used browser language/site default language to check the user language?\r\n\r\n### How to test\r\nOn a multilanguage website with language filter plugin enabled and check the cookies generated. There will be two cookies (the session cookie and the user language cookie)\r\n1. If in an HTTPS site, the language cookie is not secure and HTTP only, like the session cookie is.\r\n2. There is no way to disable the language cookie (only can set the cookie for session or year) in the language filter plugin.\r\n\r\n### System information (as much as possible)\r\nNginx 1.9.1\r\nPHP 5.6.8\r\nJoomla 3.4.1"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/105804151","html_url":"https://github.com/joomla/joomla-cms/issues/7044#issuecomment-105804151","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7044","id":105804151,"user":{"login":"andrepereiradasilva","id":9630530,"avatar_url":"https://avatars.githubusercontent.com/u/9630530?v=3","gravatar_id":"","url":"https://api.github.com/users/andrepereiradasilva","html_url":"https://github.com/andrepereiradasilva","followers_url":"https://api.github.com/users/andrepereiradasilva/followers","following_url":"https://api.github.com/users/andrepereiradasilva/following{/other_user}","gists_url":"https://api.github.com/users/andrepereiradasilva/gists{/gist_id}","starred_url":"https://api.github.com/users/andrepereiradasilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrepereiradasilva/subscriptions","organizations_url":"https://api.github.com/users/andrepereiradasilva/orgs","repos_url":"https://api.github.com/users/andrepereiradasilva/repos","events_url":"https://api.github.com/users/andrepereiradasilva/events{/privacy}","received_events_url":"https://api.github.com/users/andrepereiradasilva/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T07:46:00Z","updated_at":"2015-05-27T07:46:00Z","body":"php setcookie ha that option:\r\n```\r\nbool setcookie ( string $name [, string $value [, int $expire = 0 [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]]]] )\r\n```\r\nSee http://php.net/manual/en/function.setcookie.php"}}