4 ms·
Require SSL on any request who's response sends a set-cookie http header. Leave it out for the non-sensitive request/responses.
by walkon 16y ago
Require SSL on any request who's response sends a set-cookie http header. Leave it out for the non-sensitive request/responses.
- santry 16y agoYou'd still be able to get the cookie when the client sends it bnack to the server on subsequent, non-SSL requests. It's gotta be SSL all the time.
- deleted 16y ago[deleted]