Item6566: TWiki::LoginManager should support secure cookies

As a result, the only way to keep TWiki and the browser from happily sending the session cookie over plain HTTP is to run TWiki over HTTPS only, not even having a redirect from HTTP to HTTPS.

I suggest that a configurable extension to TWiki::LoginManager is made to set the 'secure' option for its cookie and only sending it if the TWiki::Request has the secure flag on.

Here is the change I made to _pushCookie() that works for me:

sub _pushCookie {
    my $this = shift;

    return unless $this->{twiki}->{request}->protocol() eq 'https';
    my $cookie = CGI::Cookie->new( -name => $TWiki::LoginManager::Session::NAME,
                                   -value => $this->{_cgisession}->id(),
                                   -secure => 1,
                                   -path => '/' );
...

-- TWiki:Main/StefanWalter - 2010-08-26

This sounds like a sensible enhancement. Could you post a feature request? See link in "Istanbul" pulldown menu.

-- TWiki:Main.PeterThoeny - 2010-08-26

I reformated this report and created http://twiki.org/cgi-bin/view/Codev/SecureCookiesForLoginManager. Please close this bug report then.

-- TWiki:Main.StefanWalter - 2010-08-27

Thank you. We can keep this item open. Each feature proposal has a corresponding bug item, this bug item is needed for the actual checkin.

-- TWiki:Main.PeterThoeny - 2010-08-28