5 ms·
The picture at the top of the article insinuates that this can see sessions inside https requests, but I can't find anything in the article on the specifics of
by diafygi 12y ago
The picture at the top of the article insinuates that this can see sessions inside https requests, but I can't find anything in the article on the specifics of that. How can you find the session cookie if the request uses TLS?
- egwynn 12y agoI noticed that too, and I hoped the author was going to give more info. I’m pretty sure you won’t be able to see inside an HTTPS request. That would defeat the whole point of HTTPS.
- Terr_ 12y agoNot sure. Perhaps the session-ID is when the user hits an HTTP landing page (and captured then) and the server reuses it when forwarditng/linking them to HTTPS content? You could set the "secure" flag on the cookies so that the browser only repeats them to HTTPS endpoints, but that won't help if the original header to set the cookie is sent out over HTTP.