Use different cookie names on HTTPS #368

Merged

matthijskooijman merged 1 commit from https-cookie-split into master

2020-12-30 13:26:17 +00:00

matthijskooijman commented

2020-12-30 12:24:54 +00:00

(Migrated from github.com)

To prevent this, make sure that the cookie names are different between
HTTP and HTTPS. This effectively means that HTTP and HTTPS have
independent sessions running, which is probably what would be expected
(given they can't share the same session for security reasons).

For HTTPS requests, cookies are marked as "secure", meaning they can no longer be sent over HTTP. However, this means that that cookie name is effectively unavailable (broken) for HTTP requests on the same domain. In practice, this means in a dual HTTP/HTTPS setup, sessions would stop working on HTTP once a session cookie was set up on HTTPS. To prevent this, make sure that the cookie names are different between HTTP and HTTPS. This effectively means that HTTP and HTTPS have independent sessions running, which is probably what would be expected (given they can't share the same session for security reasons).

laurensmartina (Migrated from github.com) approved these changes

2020-12-30 12:31:01 +00:00

No reviewers

laurensmartina

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

harmen/hypha!368

No description provided.

Rows
Columns