Re: [viewvc-users] how would I configure Apache to force cookies to be secure?
"C. Michael Pilato" <[email protected]>
| Newsgroups | gmane.comp.version-control.cvs.viewcvs.user |
|---|---|
| Organization | CollabNet, Inc. |
| Message-ID | <[email protected]> |
On 09/07/2010 05:09 PM, Notice Sender wrote: > Hi, > > Does anyone know how to configure Apache to force ViewVC's cookies to be > secure? > > Right now, my understanding is that any server between the browser and > the ViewVC server can steal the cookie and impersonate the logged-in > user. I think the typical way of handing this is to set cookies to be > secure (e.g. for PHP, it's setting session.cookie_secure=1). Does anyone > know the Apache counterpart for ViewVC? (I'm guessing it's a > RewriteRule, but am not sure.) ViewVC doesn't use session cookies (or any cookies, for that matter). If you configure ViewVC to use weak authentication (Basic auth over unencrypted HTTP), then sure, someone could sniff the Basic auth credentials and use them. If that's a concern, then don't do that. Use SSL or somesuch. -- C. Michael Pilato <[email protected]> CollabNet <> www.collab.net <> Distributed Development On Demand ------------------------------------------------------ http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2656617 To unsubscribe from this discussion, e-mail: [[email protected]].
signature.asc
(application/pgp-signature, 198 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAkyG6q8ACgkQokEGqRcG/W6F4ACfYvMKCv2d8DRuK3W3u3w+FInz h0gAn389Q9xmN3EI5804+qr+1Tft+9fE =AJVZ -----END PGP SIGNATURE-----