When I visit a SE site via plain http (such as http://meta.photo.stackexchange.com), I appear as logged in, so it means that the cookies were not set to secure (when I used other SE sites through https) and are transmitted in plaintext in case any such link is followed.

Combined with the fact there's no way to force session expiration (when logging in with Google), this is a major problem that needs to be fixed.

At the very least, cookies must be set to be secure.

  • 1
    HTTPS isn't fully supported yet, so doing that would completely break login for us. It's coming, though. – animuson Jul 20 '16 at 6:41
  • @animuson How high on the priority list is that? – Magisch Jul 20 '16 at 6:44
  • @Magisch I wouldn't exactly classify it in any priority. But the *.meta.stackexchange.com scheme is currently being tested to make sure nothing gets broken beyond belief. It's all being actively worked on. – animuson Jul 20 '16 at 6:51
  • 1
    Related: nickcraver.com/blog/2013/04/23/… – Oded Jul 20 '16 at 8:24

You must log in to answer this question.

Browse other questions tagged .