web commit by JamesWestby

1 files changed, 20 insertions, 0 deletions

diff --git a/doc/patchqueue/use-ssl-for-cookies.mdwn b/doc/patchqueue/use-ssl-for-cookies.mdwn
new file mode 100644
index 000000000..c2ee63782
--- /dev/null
+++ b/doc/patchqueue/use-ssl-for-cookies.mdwn
@@ -0,0 +1,20 @@
+It is very easy to stop the password being sniffed, you just use https:// for cgiurl
+(with appropriately configure server of course), and disallow access to the cgiscript
+over http.
+
+However the cookie is still sent for all requests, meaning that it could be stolen.
+I don't know quite how well CGI::Session defends against this, but the best it could
+do is probably tie it to an IP address, but that still leaves room for abuse.
+
+I have created a patch that adds a config option sslcookie, which causes the
+cookie to have it's secure property set. This means that it is only sent over SSL.
+So if you can configure apache to do what you want, you only have to change two options
+(cgiurl and sslcookie) to encrypt all authentication data.
+
+The disadvantage is that if someone were to activate it while using http:// I think it
+would mean they couldn't log in, as the browser would never offer the cookie. 
+I think I have made the documentation clear enough on this point.
+
+http://jameswestby.net/scratch/sslcookie.diff
+
+-- JamesWestby
\ No newline at end of file