the buglinks from bonsai are still using http instead of https; using https would avoid sending the logincookie over an unencrypted connection, and also avoid the redirection.
Status: NEW → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Myk, Dave: should we be setting "secure=yes" on the login cookie if the initial login was over SSL? Gerv
IMHO we should be encrypting all communications between users and Bugzilla, at least for logged in users, in which case we wouldn't need to flag logins as secure. If we don't encrypt all communications, and particularly if we allow users to log in insecurely, then it might make sense to know who logged in how. What would we use the information for?
> IMHO we should be encrypting all communications between users and Bugzilla, at > least for logged in users, in which case we wouldn't need to flag logins as > secure. I'm not sure of your logic here. If you don't set "secure=yes", then when an already-logged-in user clicks an HTTP link to Bugzilla (such as used to be on Bonsai), an HTTP request is made with cookies, which is then redirected to an HTTPS request. So the cookies go in the clear. If you set "secure=yes", then that initial HTTP link which gets redirected happens _without_ cookies, so the cookies don't go in the clear. This is what I'm suggesting. Or have I misunderstood how this works? Gerv
Urm, sorry, I misunderstood. Yes, we should be setting secure=yes, even though tokens in the clear are only mildly problematic (authentication credentials and confidential bug information are the more important data to secure).
Product: mozilla.org → mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.