4

When I visit a SE site via plain http (such as http://meta.photo.stackexchange.com), I appear as logged in, so it means that the cookies were not set to secure (when I used other SE sites through https) and are transmitted in plaintext in case any such link is followed.

Combined with the fact there's no way to force session expiration (when logging in with Google), this is a major problem that needs to be fixed.

At the very least, cookies must be set to be secure.

Improve this question
4
  • 1
    HTTPS isn't fully supported yet, so doing that would completely break login for us. It's coming, though.
    – animuson StaffMod
    Commented Jul 20, 2016 at 6:41
  • @animuson How high on the priority list is that?
    – Magisch
    Commented Jul 20, 2016 at 6:44
  • @Magisch I wouldn't exactly classify it in any priority. But the *.meta.stackexchange.com scheme is currently being tested to make sure nothing gets broken beyond belief. It's all being actively worked on.
    – animuson StaffMod
    Commented Jul 20, 2016 at 6:51
  • 1
    Related: nickcraver.com/blog/2013/04/23/…
    – Oded StaffMod
    Commented Jul 20, 2016 at 8:24

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .