Improve HTTPS support and security
Open
- Dominant language
- PHP
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
The authentication cookie sent over HTTPS must not be the same used over HTTP otherwise it defeats the security of HTTPS in case of a HTTP connection. Two cookies (being one common to both kinds of connections and another exclusive to HTTPS) can fix this issue.
A option for HTTP(S) shall be included. In this case connections to HTTP will be redirect to HTTPS. The mechanics and logic for this feature are yet to be defined.
Source files such as JavaScript must be sent over HTTPS when browsing HTTPS pages otherwise it defeats the purpose of a secure connection in case of the JS being compromised.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.