3 ms·
Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than
by eridius 10y ago
Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http:// http://.
- tonyztan 10y agoMany browser features (like location API) are gradually being deprecated from plaintext HTTP.
- eridius 10y agoInteresting. I hadn't heard of that before. Looks like it's just Chrome doing this?
- richardwhiuk 10y agoAnd Firefox
- JoshTriplett 10y agoIn addition to limiting certain browser features to HTTPS sites, browsers now also warn about submitting passwords over HTTP and mark pages that do so as insecure. Browsers also prevent HTTPS sites from embedding active content from HTTP sites.