Closed
Bug 449983
Opened 17 years ago
Closed 17 years ago
Cookies should be created as SSL-only
Categories
(addons.mozilla.org Graveyard :: Administration, defect)
Tracking
(Not tracked)
VERIFIED
DUPLICATE
of bug 449974
People
(Reporter: morgamic, Assigned: morgamic)
Details
We don't have the secure flag on our AMO cookies, which means that if someone did a man-in-the-middle attack they could steal AMO sessions.
Most AMO traffic that is automated uses https:// explicitly, but when people type in the domain it has to redirect from http->https. That scenario is the one of concern.
|
Assignee | |
Comment 1•17 years ago
|
||
We need to:
* patch cookie creation to create cookies with the secure bit
* nuke all existing AMO sessions
We could also consider:
* disabling http->https redirects
|
|
Assignee | |
Updated•17 years ago
|
Assignee: nobody → morgamic
|
|
Assignee | |
Updated•17 years ago
|
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → DUPLICATE
|
||
Updated•16 years ago
|
Group: client-services-security
|
||
Updated•9 years ago
|
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in
before you can comment on or make changes to this bug.
Description
•