+
+ // Audit some additional settings for logging purposes.
+ prop = sessionProps->getString("cookieProps");
+ if (!prop.first) {
+ log.warn("empty/missing cookieProps setting, set to \"https\" for SSL/TLS-only usage");
+ }
+ else if (!strcmp(prop.second, "http")) {
+ log.warn("insecure cookieProps setting, set to \"https\" for SSL/TLS-only usage");
+ }
+ else if (strcmp(prop.second, "https")) {
+ if (!strstr(prop.second, ";secure") && !strstr(prop.second, "; secure"))
+ log.warn("custom cookieProps setting should include \"; secure\" for SSL/TLS-only usage");
+ else if (!strstr(prop.second, ";HttpOnly") && !strstr(prop.second, "; HttpOnly"))
+ log.warn("custom cookieProps setting should include \"; HttpOnly\", site is vulnerable to client-side cookie theft");
+ }
+
+ pair<bool,bool> handlerSSL = sessionProps->getBool("handlerSSL");
+ if (handlerSSL.first && !handlerSSL.second)
+ log.warn("handlerSSL should be enabled for SSL/TLS-enabled web sites");