3 ms·
SSL is a sweet bonus feature. Is this on Heroku?
by kmfrk 13y ago
SSL is a sweet bonus feature. Is this on Heroku?
- lucb1e 13y agoHttps should be default when handling logins. I won't use one of my strong passwords on non-https websites.
- mike-cardwell 13y agoHe's not using Strict Transport Security. The cookies that I can see don't have the secure flag set. I can't see a session cookie as I will not sign up to this service until he fixes the login. But I'm going to assume he hasn't set the secure flag on that either. Which all boils down to the following: An active MITM can trivially steal your session cookie and take over your account.