Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add 'secure' to session cookie if terminated by proxy #1889

Closed
mworrell opened this issue Mar 19, 2018 · 0 comments

Comments

@mworrell
Copy link
Member

commented Mar 19, 2018

Right now mod_ssl adds the secure attribute to the session cookie if the connection is a TLS connection.

The secure flag should also be added if the site.protocol configuration is set to https and the TLS connection is terminated by a proxy.

@mworrell mworrell added the security label Mar 19, 2018
@mworrell mworrell added this to the 0.38 milestone Mar 19, 2018
@mworrell mworrell self-assigned this Mar 19, 2018
mworrell added a commit that referenced this issue Mar 19, 2018
ddeboer added a commit that referenced this issue Mar 19, 2018
@ddeboer ddeboer closed this Apr 1, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.