3 ms·

Wait, the check for whether a user always wants to use HTTPS is done after they login over HTTP?

• abraham 16y ago
  Login is POSTed to a SSL endpoint at which point cookies are set that are SSL only. Passwords are never sent over a non-SSL request.
  • lamby 16y ago
    Thanks. Although without HTTP STS or similar I could still MITM the landing page.. :)
    • abraham 16y ago
      Very true! I hadn't even thought of that.