aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJoey Hess <joey@kitenet.net>2010-11-29 14:09:02 -0400
committerJoey Hess <joey@kitenet.net>2010-11-29 14:09:02 -0400
commite7cb11b40735a976f0cb565824c3d892bd75af44 (patch)
tree40f29727be5748a6a63f3f1fe3e7a9ca4e6103ee
parent170cb0247926d0b7c736e61b2ff66d6a3095f271 (diff)
downloadikiwiki-e7cb11b40735a976f0cb565824c3d892bd75af44.tar
ikiwiki-e7cb11b40735a976f0cb565824c3d892bd75af44.tar.gz
comment
-rw-r--r--doc/todo/use_secure_cookies_for_ssl_logins.mdwn13
1 files changed, 13 insertions, 0 deletions
diff --git a/doc/todo/use_secure_cookies_for_ssl_logins.mdwn b/doc/todo/use_secure_cookies_for_ssl_logins.mdwn
index a91a15b98..a7030d08c 100644
--- a/doc/todo/use_secure_cookies_for_ssl_logins.mdwn
+++ b/doc/todo/use_secure_cookies_for_ssl_logins.mdwn
@@ -10,3 +10,16 @@ This branch adds `sslcookie => 0, sslcookie_auto => 1` as an option; this
uses the `HTTPS` environment variable, so if you log in over SSL you'll
get a secure session cookie, but if you log in over HTTP, you won't.
(The syntax for the setup file is pretty rubbish - any other suggestions?)
+
+> Does this need to be a configurable option at all? The behavior could
+> just be changed in the sslcookie = 0 case. It seems sorta reasonable
+> that, once I've logged in via https, I need to re-login if I then
+> switch to http.
+>
+> And, if your change is made, the sslcookie option could probably itself
+> be dropped too -- at least I don't see a real use case for it if ikiwiki
+> is more paranoid about cookies by default.
+>
+> Might be best to fix
+> [[todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both]]
+> first, so that dual https/http sites can better be set up. --[[Joey]]