Re: node red, and black is wonky

On Sat, Apr 5, 2008 at 8:00 PM, coderman <[email protected]> wrote:
> ...
>  note that gmail does not bind auth cookies to "secure only",

here are the technical details for curious.  use Live HTTP Headers or
a sniffer (with SSL/TLS MITM) to observe.

For a secure site, the session cookie will be set like:

"Set-Cookie: ESSID=...; path=/; domain=www.$foo.com; secure; HttpOnly"

the "secure;" part is the critical component which tells the browser
not to send this cookie associated with the domain unless SSL/TLS is
in use.

for gmail, you see:

"Set-Cookie: SID=...;Domain=.google.com;Path=/"

which makes the vulnerability to sidejacking apparent.

best regards,

-- 
The Personal Telco Project - http://www.personaltelco.net/
Donate to PTP: http://www.personaltelco.net/donate
Un/Subscribe:  http://lists.personaltelco.net/mailman/listinfo/general/
Archives:  http://news.gmane.org/gmane.network.wireless.portland.general/
Etiquette: http://www.personaltelco.net/index.cgi/MailingListEtiquette