3 ms·
I don't understand the distinction between the login form and every other page of the site. If someone is logged in and then back to normal http, someone can ju
by jordanlev 11y ago
I don't understand the distinction between the login form and every other page of the site. If someone is logged in and then back to normal http, someone can just grab the cookie and pretend to be that person already-logged-in.
I suppose if one uses the same password for every account they have then knowing their password is more harmful than just having access to 1 site... but other than that it seems like a distinction without a difference.
- throwaway7767 11y ago> If someone is logged in and then back to normal http, someone can just grab the cookie and pretend to be that person already-logged-in. If the cookie is set through HTTPS, the browser won't send it when loading HTTP resources. So the cookie won't be exposed that way. We should still be using HTTPS for all traffic in 2016.
- oxplot 11y agoIf a website only uses HTTPS for login, then it has to set a cookie for HTTP as well, otherwise how will the user navigate the site after login? From top of my head, you can implement this by associating the randomly generated session ID that you assign to all visitors, with the login ID. Regardless, what jordanlev said still applies. The session can be hijacked.
- jordanlev 11y agoExactly! What is the purpose of being "logged in" if when you then go to browse the rest of the site you are no longer actually "logged in" (because the secure HTTPS cookie isn't being sent on those insecure http: pages).
- 4mnt 11y ago> If the cookie is set through HTTPS, the browser won't send it when loading HTTP resources. If the cookie is set through HTTPS and does not have the Secure flag set, the browser will happily send it along when loading HTTP resources.
- deleted 11y ago[deleted]
- flurpitude 11y agoThe cookie would tend to be for one session only. The login credentials can be used to create subsequent sessions.
- underbluewaters 11y agoYou answered your own question. If a site works this way it is risking the privacy of user data on itself, but at least it isn't endangering the credentials which may be useable to attack other sites.
- newman314 11y agoPreviously when crypto was expensive, there were (and still are, PG&E is one and Mariott another) people thought just doing login over ssl was sufficient.