4 ms·
In addition, the web interface lacks: - 2-factor auth [1] - X-Frame-Options [2] - HSTS [2] - Redirect from http to https prior to login. (if someone bookmar
by harshreality 14y ago
In addition, the web interface lacks:
- 2-factor auth [1]
- X-Frame-Options [2]
- HSTS [2]
- Redirect from http to https prior to login. (if someone bookmarks the http url, for example, they can be mitm'd anytime they use that bookmark) [2]
These have been pointed out on the forums long ago (see cites) but have not been implemented.
[1] http://forum.linode.com/viewtopic.php?f=7&t=7639 http://forum.linode.com/viewtopic.php?f=7&t=7639
[2] http://forum.linode.com/viewtopic.php?f=7&t=8764 http://forum.linode.com/viewtopic.php?f=7&t=8764
- JshWright 14y agoIt doesn't always redirect... If you visit http://manager.linode.com/session/index http://manager.linode.com/session/index it'll happily let you log in via HTTP.