620910 - Kitsune should automatically switch to https if credentials were already provided in the current session

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Underpass]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.2.13) Gecko/20101203 Debian Firefox/3.6.13
Build Identifier: 

As for the subject: If I am in the Localization Dashboard

http://support.mozilla.com/it/localization

and try to edit an article needing updates, the credentials are required again.

Reproducible: Always

Steps to Reproduce:
1. Delete cookies for support.mozilla.com
2. Login
3. Open Localization Dashboard with http://support.mozilla.com/it/localization
4. Click on a link to an article needing updates (e.g. http://support.mozilla.com/it/kb/Come%20sincronizzare%20le%20impostazioni%20di%20Firefox%20tra%20pi%C3%B9%20computer/edit)
Actual Results:  
I'm asked to type login/password again

Expected Results:  
Since I'm already in for the session, it should be not necessary.

Comment 1

[James Socol [:jsocol, :james]]

If we set the SUMOloggedin cookie during log-in, there's already a hook in apache to do this.

(SUMOloggedin is a cookie with no particularly meaningful value, that is _not_ secure, so it gets sent on all requests. Not a session cookie but an "o hai there's probably a session" cookie.)

Comment 2

[Kadir Topal [:atopal]]

James, should I also file a bug for being able to select whether your want to stay signed in?

Comment 3

[Peter Bengtsson [:peterbe]]

This is true of any page in fact. I did this:

1. Google for something "foobar site:support.mozilla.com"
2. Open two tabs (both on http)
3. Log in in one of the tabs and close it
4. Review the other tab and decide to post a reply
5. Reload the page and I'm still not logged in

Comment 4

[James Socol [:jsocol, :james]]

(In reply to comment #3)
> This is true of any page in fact. I did this:

That's because all pages are served by Kitsune now ;)

Comment 5

[James Socol [:jsocol, :james]]

Actually, let's solve this with middleware in Python. Trying to minimize the Apache specifics.

Comment 6

[James Socol [:jsocol, :james]]

https://github.com/jsocol/kitsune/compare/dcec7a9...85a641c

Logging in should set a cookie, called sumo_session right now, with a value of 1. That should get sent on both HTTP and HTTPS requests, and if it's sent on an HTTP request, you should be redirected to HTTPS.

Comment 7

[James Socol [:jsocol, :james]]

Logging out should clear the cookie but we never explicitly redirect back to HTTP.

Comment 8

[Rebecca Billings [:rbillings]]

Verified cookie is set/removed based on sign in status, no redirect to HTTP after logging out.