Closed Bug 567469 Opened 15 years ago Closed 14 years ago

Use SSL to Protect Submitted Passwords & Session Ids

Categories

(Websites :: Other, defect)

Product:
Websites
Component:
Other
Type:
defect
Priority:
Not set
Severity:
major

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: mcoates, Unassigned)

References

(
URL
)

Details

(Whiteboard: [infrasec:tls])

Issue SSL is not currently used for any of the sixgill pages (http://dm-sixgill01.mozilla.org). As a result the login process will always transmit the username and password in clear text from the client to the server. Recommended Remediation Use SSL throughout the entire site to protect the password submitted during login and any session identifiers to represent the authenticated user. All requests to non-ssl pages should immediately redirect to the SSL login page. It is also recommended to set the force-tls header to instruct compatible browsers to always request the page over SSL.
Group: core-security → websites-security
Component: Rewriting and Analysis → Other
Product: Core → Websites
QA Contact: rewriting-and-analysis → other
Group: websites-security → core-security
Component: Other → Rewriting and Analysis
Product: Websites → Core
QA Contact: other → rewriting-and-analysis
Group: core-security → websites-security
Component: Rewriting and Analysis → Other
Product: Core → Websites
QA Contact: rewriting-and-analysis → other
Is this fixed now? If I try to get to any of the dm-sixgill01 pages under http then I'm redirected to the main page under https.
It looks like they have made some changes towards resolving this. Has the login been removed? I don't see a link for it anymore. I'd like to test that before closing this.
I'm going to be removing the whole half-baked cleartext login system today so all authentication is through LDAP, will post here when that's ready to look at.
The non-LDAP login system has been removed in the latest reports.
This still needs review.
Confirmed old auth system is removed. LDAP auth is over https
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.