News for hackers. Stuff that matters.

A comment on GitHub moves to SSL, but remains Firesheepable.

Re:GitHub moves to SSL, but remains Firesheepable by rtomayko on Wednesday November 03, 2010 @12:33PM (#1865351)
We fat fingered the config. The cookie is marked secure now but we found another issue where it's being sent back on redirected HTTP requests. It should be all plugged up in a bit.
[ Parent | on HN ]
Re:GitHub moves to SSL, but remains Firesheepable by rtomayko on Wednesday November 03, 2010 @12:58PM (#1865447)
Okay. The session cookie is marked secure and is sent only in response to HTTPS requests. That should cover everything.
[ Parent | on HN ]
Re:GitHub moves to SSL, but remains Firesheepable by percept on Wednesday November 03, 2010 @01:02PM (#1865473)
Somebody get this guy some karma.
[ Parent | on HN ]