[ php-blog-Bugs-1547073 ] When using https for admin, cookies not always sent securely

Bugs item #1547073, was opened at 2006-08-26 09:19
Message generated for change (Comment added) made by garvinhicking
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1547073&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Administrative functions
Group: None
>Status: Pending
>Resolution: Works For Me
Priority: 1
Submitted By: Lynoure Braakman (lynoure)
Assigned to: Garvin Hicking (garvinhicking)
Summary: When using https for admin, cookies not always sent securely

Initial Comment:
When the admin has been set to use https, the request
for serendipity_admin.css is still sent over plain http
and the cookies get sent along. This leaks the
authentication data which is stored in a cookie.

----------------------------------------------------------------------

>Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-27 10:37

Message:
Logged In: YES 
user_id=473563

Hi!

When you logged in once via HTTP this means that your cookie
is already set! Remove your cookie (via your browser's
interface) and then login to HTTPS, and you will not have a
HTTP cookie.

If there are links that point to http:// when viewing a
https:// location, we definitely would need to fix those.
Could you make a list of those? The comment link actually
does use https:// when I am browsing with https:// - they
should all use $serendipity['baseURL'] which gets the
https:// prefix when you use that URL.

Of course you could also configure your browser so that
cookies are not accepted on your http:// site...?

About secure cookies, you might want to check the
'serendipity_setcookie' function in
include/functions_config.inc.php?

Best regards,
Garvin
Best regards,
Garvin

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-27 09:25

Message:
Logged In: YES 
user_id=267173

Unfortunately that was not enough. The author_information 
cookie get sent even when browsing the non-admin side of 
the blog. 

Also some admin links appear when reading the blog (e.g. 
Disallow commenting) and those are all http. Ironically 
without "Auto-Detect HTTP Host" on those links are https.

Is there some way to constrain the sensitive cookies to 
https by configuration? I have also been thinking of ways 
of checking if admin has been set to use SSL and if so 
setting    secure true   for the author_information 
cookie.

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-26 13:32

Message:
Logged In: YES 
user_id=267173

Thanks, that helped. Sorry for the hassle. 

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-26 13:27

Message:
Logged In: YES 
user_id=473563

Hi!

Ah! You must set "Auto-Detect HTTP Host" in your serendipity
configuration, so that the 'baseURL' directive will
automatically switch to the host you use.

Best regards,
Garvin

----------------------------------------------------------------------

Comment By: Lynoure Braakman (lynoure)
Date: 2006-08-26 13:14

Message:
Logged In: YES 
user_id=267173

Hmm, I'm using the 1.0.1

All other requests do go neatly by https except the one for
serendipity_admin.css

I think serendipity_rewriteURL is adding the http from 
$serendipity['baseURL'].  My base URL is http, only the
admin part is set to use ssl.

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2006-08-26 09:40

Message:
Logged In: YES 
user_id=473563

Hi!

Which s9y version are you using? It works for me, since all
URLs in s9y's admin backend are either relative (and thus
use the current host) or if absolute, use the 'https://' prefix?

Best regards,
garvin

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1547073&group_id=75065

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642