564003 - Review LDAP Security in Sandboxes

Status: RESOLVED INVALID

(Socorro :: General, task)

Description

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

This is a security concern that came up during the security talk at the webdev onsite week.  Our sandboxes are not setup with HTTPS support.  When we access the /admin area of the site, we are required to login to LDAP.  My concern is that we're logging into LDAP over HTTP, and that our actual Moz usernames and passwords are going over the wire in clear text.  This being the case, we should either provide HTTPS support for our sandboxes or allow access to /admin for unauthenticated users in the sandbox area only.

Comment 1

[Robert Kaiser]

Has this been looked into? Sounds like something that should be lying around in a public bug report for as long as it already has...

Comment 2

[Laura Thomson :laura]

Sandboxes on khan require VPN which requires LDAP.
Stage forces https.