#24511: New feature: Make the session cookie secure if and only if
request.is_secure()
-------------------------------+--------------------------------------
Reporter: aptiko | Owner: nobody
Type: Uncategorized | Status: new
Component: Uncategorized | Version: 1.7
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Changes (by erikr):
* needs_better_patch: => 0
* needs_tests: => 0
* needs_docs: => 0
Comment:
Although seemingly logical, I think this is not a good plan. I can think
of several issues where the logic would get very complex, but most of all,
I don't think Django should introduce implicit behaviour to benefit mixed
security sites. Mixed security sites are awful, security wise, and Django
should not encourage such setups. A minor flaw in the logic of when
cookies should be secure can severely compromise the security of a site.
And even if the session cookie is 100% safe, a mixed security site offers
opportunities for active interception to prevent redirects to https, or
change the URL behind the login button, etc.
The resolution to your problem is to simply run your entire site over
https.
I'm closing this as wontfix -
--
Ticket URL: <https://code.djangoproject.com/ticket/24511#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.98711538feaae188628a01428d5a82cc%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
