Closed Bug 261535 Opened 20 years ago Closed 18 years ago

We should set "secure=yes" in cookies when using HTTPS.

Categories

(Bugzilla :: User Accounts, defect)

Product:
Bugzilla
Component:
User Accounts
Version:
2.18
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
VERIFIED DUPLICATE of bug 381569

People

(Reporter: gerv, Unassigned)

Details

Pants. OK, here's an initial description. We should set "secure=yes" in cookies when using HTTPS. If you don't set "secure=yes", then when an already-logged-in user clicks an HTTP link to Bugzilla (such as used to be on Bonsai), an HTTP request is made with cookies, which is then redirected to an HTTPS request. So the cookies go in the clear. If you set "secure=yes", then that initial HTTP link which gets redirected happens _without_ cookies, so the cookies don't go in the clear. Gerv
QA Contact: mattyt-bugzilla → default-qa
Assignee: myk → user-accounts
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.