Re: Secure cookie handling upon https to http downgrade

2023-01-02 Thread Jo-Philipp Wich
Hi, > More generally, and regard to the earlier suggestion, I would still suggest > splitting the http vs https cookie names in any ongoing luci rework in order > to avoid this situation. this also has been implemented already, see https://github.com/openwrt/luci/commit/08fb38399f5b297be7d460703b

Re: Secure cookie handling upon https to http downgrade

2023-01-02 Thread Peter Naulls
On 12/30/22 15:42, Jo-Philipp Wich wrote: Hi, [...] I renamed the new cookies to "http-sysauth" and "https-sysauth", to work around this and it seems to do the right thing.  But there is still a fault here. Already fixed with https://github.com/jow-/lucihttp/commit/6e68a1065f3ed1889e5fa053b

Re: Secure cookie handling upon https to http downgrade

2022-12-30 Thread Jo-Philipp Wich
Hi, > [...] > I renamed the new cookies to "http-sysauth" and "https-sysauth", to work > around this and it seems to do the right thing.  But there is still a fault > here. Already fixed with https://github.com/jow-/lucihttp/commit/6e68a1065f3ed1889e5fa053b206bd3aa108bd5f ~ Jow signature.as

Re: Secure cookie handling upon https to http downgrade

2022-12-30 Thread Peter Naulls
On 12/22/22 15:56, Peter Naulls wrote: On 12/22/22 13:50, Oscar Hjelm wrote: I’m not familiar with the luci interface, but to help you get started: - One workaround would be to use a different cookie name on the new secure cookies (or a new name on the older cookies, if that is preferred). Th

Re: Secure cookie handling upon https to http downgrade

2022-12-22 Thread Peter Naulls
On 12/22/22 13:50, Oscar Hjelm wrote: I’m not familiar with the luci interface, but to help you get started: - One workaround would be to use a different cookie name on the new secure cookies (or a new name on the older cookies, if that is preferred). The two cookies could co-exist. Yes, th

Secure cookie handling upon https to http downgrade

2022-12-22 Thread Peter Naulls
Some background. I have two versions of OpenWrt code: One is legacy version based upon a mismash of versions, but is approximately luci code from mid-2021. The webserver is http only. I'm able to change this code for bug fixes, but don't want to pull in anything too large. The other is bas