undefined | Better HN

0 pointsoxplot4y ago0 comments

That only protects the user's password. The auth cookie will be sent in all subsequent requests in plain text.

EDIT: that's how firesheep (https://en.wikipedia.org/wiki/Firesheep) hijacked sessions for e.g.

0 comments

nly4y ago

That's not true. Cookies can have a 'secure' attribute which tells the browser to send them only over TLS

chc4y ago

But that just makes your login not work if the rest of your site is HTTP, doesn't it?

You should not show authenticated pages without HTTPS

oxplotOP4y ago

A secure cookie would be of no use for a site whose only secure page is the login page, which is what the parent post I replied to was talking about.

eli4y ago

in 2011?

Yes

j / k navigate · click thread line to collapse