4 ms·
Would a mixed (http + https) site with cookieless http traffic (from a different domain) be secure? Could something like this be included in the spec?
by grandalf 16y ago
Would a mixed (http + https) site with cookieless http traffic (from a different domain) be secure? Could something like this be included in the spec?
- pornel 16y agoIf you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't. Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).
- grandalf 16y agoahh ok, that's true. Hadn't thought of that. Is there a caching solution that supports https?