[Skip to main content](#vessel-content) # Security Concerns ## - **[epafos](/forum/user/59726-epafos "View epafos's Profile")** - [![epafos's Avatar](https://www.hikashop.com/media/kunena/core/svg/person.svg)](/forum/user/59726-epafos "View epafos's Profile") Topic Author - [ Offline](/forum/user/59726-epafos) Less More - Posts: 10 - Thank you received: 2 - - 4 years 11 months ago [\#337545](#337545) by [epafos](/forum/user/59726-epafos "View epafos's Profile") *[Security Concerns](/forum/2-general-talk-about-hikashop/903583-security-concerns#337545 "-- HikaShop version -- : 4.4.4 -- Joomla version -- : 3.10.3 -- PHP version -- : 7.4 We run a security report about our website and there are some issues that i dont know if i should be concerned about or not. there are a lot of notification about Cookie No HttpOnly Flag for hikashop_cart_session_id and hikashop_cart_id. Both of theme are shown with the following notification A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible Also there is a notification for Absence of Anti-CSRF Tokens on addressed such us Should i be concerned?")* was created by *[epafos](/forum/user/59726-epafos "View epafos's Profile")* -- HikaShop version -- : 4.4.4 -- Joomla version -- : 3.10.3 -- PHP version -- : 7.4 We run a security report about our website and there are some issues that i dont know if i should be concerned about or not. there are a lot of notification about **Cookie No HttpOnly Flag** for hikashop_cart_session_id and hikashop_cart_id. **Both of theme are shown with the following notification** *A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible* Also there is a notification for Absence of Anti-CSRF Tokens on addressed such us <form action="/menuitem/product/updatecart" method="post" name="hikashop_product_form" onsubmit="return hikashop_product_form_check();" enctype="multipart/form-data"> Should i be concerned? Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzItZ2VuZXJhbC10YWxrLWFib3V0LWhpa2FzaG9wLzkwMzU4My1zZWN1cml0eS1jb25jZXJucz90bXBsPW1hcmtkb3du) or [Create an account](/register) to join the conversation. - **[nicolas](/forum/user/63-nicolas "View nicolas's Profile")** - [![nicolas's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar63.png?1793428657)](/forum/user/63-nicolas "View nicolas's Profile") - [ Away](/forum/user/63-nicolas) Less More - Posts: 86322 - Thank you received: 14280 - - 4 years 11 months ago [\#337549](#337549) by [nicolas](/forum/user/63-nicolas "View nicolas's Profile") Replied by *[nicolas](/forum/user/63-nicolas "View nicolas's Profile")* on topic *[Security Concerns](/forum/2-general-talk-about-hikashop/903583-security-concerns#337549 "-- HikaShop version -- : 4.4.4 -- Joomla version -- : 3.10.3 -- PHP version -- : 7.4 We run a security report about our website and there are some issues that i dont know if i should be concerned about or not. there are a lot of notification about Cookie No HttpOnly Flag for hikashop_cart_session_id and hikashop_cart_id. Both of theme are shown with the following notification A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible Also there is a notification for Absence of Anti-CSRF Tokens on addressed such us Should i be concerned?")* Hi, No worries. Even if javascript can access or even modify these cookies, they won't be able to do anything with them. Their role is to store the cart id of the current user with his old session id in case his session changes (because it times out) so that the user can still see his cart on your website. First, you can't overtake the cart if it's linked to a user account. And second, for guests, even if the attacker would be able to overtake the cart of someone else it would just be able to see what products were in the cart. So it's not a security concern as he won't be able to overtake the would session with that, which could be problematic. Finally, the HttpOnly flag is almost useless as it can be circumvented and attackers usually use other; more effective, methods: [ portswigger.net/research/web-storage-the...sion-tokens#httponly](https://portswigger.net/research/web-storage-the-lesser-evil-for-session-tokens#httponly) Similarly, not having a CSRF token for the add to cart process is not a problem. It would only allow an attacker to force a product of your website to the cart of your users. Adding such a token would even be a problem as it would prevent some easy customization with just the add to cart link of the products that many merchants rely on in their shop. The following user(s) said Thank You: [epafos](/forum/user/59726-epafos "View epafos's Profile") Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzItZ2VuZXJhbC10YWxrLWFib3V0LWhpa2FzaG9wLzkwMzU4My1zZWN1cml0eS1jb25jZXJucz90bXBsPW1hcmtkb3du) or [Create an account](/register) to join the conversation. Board Categories HikaShop Install & Update Product & Category Display Content Creation Sales and Orders Orders management Reports & Statistics Customers Checkout Payment Methods Shipping Methods Import & Export (CSV, XLS…) Specific Features Affilation Taxes Wishlist Vote Carousel & Slider Mass Actions Filters & Search Discount & Coupon Feature Request Integrations Showcase General Talk about HikaShop Development HikaShop 3.0 Beta Translation Commercial Jobs HikaShop Components HikaMarket Market: Feature requests Market: How to? Market: Bug Report HikaSerial General talk about HikaSerial Serial: Bug Report Serial: How to? Support en Français de HikaSerial (French Support) HikaSubscription HikaAuction Auction: Feature requests Auction: How to? Auction: Bug report Hikashop around the world Support en Français (French Support) Russian FAQ. Курс выживания с Hikashop. Частые вопросы и о Расширения Hikashop Наши сайты на Hikashop 日本語版サポート(Japanese Support) Thai German Archives Bug Report How to? [](/forum/topics/feed/mode-topics?format=feed&type=rss) Time to create page: 0.071 seconds [Powered by](/forum/credits) [Kunena Forum](https://www.kunena.org)