diff options
| author | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2006-08-27 20:25:05 +0000 |
|---|---|---|
| committer | joey <joey@0fa5a96a-9a0e-0410-b3b2-a0fd24251071> | 2006-08-27 20:25:05 +0000 |
| commit | 4ad7c9d6257ca106b2949d22f6300823190991a0 (patch) | |
| tree | 9752444cfa70b40ab32627e3feb44781e56f2771 /doc | |
| parent | 3ad4d93e33284ad6d51d2fa5f9abf1943b894d48 (diff) | |
| download | ikiwiki-4ad7c9d6257ca106b2949d22f6300823190991a0.tar ikiwiki-4ad7c9d6257ca106b2949d22f6300823190991a0.tar.gz | |
* Patch from James Westby to add a --sslcookie switch, which forces
cookies to only be sent over ssl connections to avoid interception.
* Factor out the cgi header printing code into a new function.
* Fix preferences page on anonok wikis; still need to sign in to get
to the preferences page.
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/ikiwiki.setup | 2 | ||||
| -rw-r--r-- | doc/patchqueue/use-ssl-for-cookies.mdwn | 20 | ||||
| -rw-r--r-- | doc/security.mdwn | 4 | ||||
| -rw-r--r-- | doc/usage.mdwn | 6 |
4 files changed, 11 insertions, 21 deletions
diff --git a/doc/ikiwiki.setup b/doc/ikiwiki.setup index bf1aa3703..9a4b61ec4 100644 --- a/doc/ikiwiki.setup +++ b/doc/ikiwiki.setup @@ -74,6 +74,8 @@ use IkiWiki::Setup::Standard { #timeformat => '%c', # Locale to use. Must be a UTF-8 locale. #locale => 'en_US.UTF-8', + # Only send cookies over SSL connections. + #sslcookie => 1, # Logging settings: verbose => 0, syslog => 0, diff --git a/doc/patchqueue/use-ssl-for-cookies.mdwn b/doc/patchqueue/use-ssl-for-cookies.mdwn deleted file mode 100644 index c2ee63782..000000000 --- a/doc/patchqueue/use-ssl-for-cookies.mdwn +++ /dev/null @@ -1,20 +0,0 @@ -It is very easy to stop the password being sniffed, you just use https:// for cgiurl -(with appropriately configure server of course), and disallow access to the cgiscript -over http. - -However the cookie is still sent for all requests, meaning that it could be stolen. -I don't know quite how well CGI::Session defends against this, but the best it could -do is probably tie it to an IP address, but that still leaves room for abuse. - -I have created a patch that adds a config option sslcookie, which causes the -cookie to have it's secure property set. This means that it is only sent over SSL. -So if you can configure apache to do what you want, you only have to change two options -(cgiurl and sslcookie) to encrypt all authentication data. - -The disadvantage is that if someone were to activate it while using http:// I think it -would mean they couldn't log in, as the browser would never offer the cookie. -I think I have made the documentation clear enough on this point. - -http://jameswestby.net/scratch/sslcookie.diff - --- JamesWestby
\ No newline at end of file diff --git a/doc/security.mdwn b/doc/security.mdwn index dc763ef40..9d7702dde 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -134,7 +134,9 @@ file not be world readable. Login to the wiki involves sending a password in cleartext over the net. Cracking the password only allows editing the wiki as that user though. -If you care, you can use https, I suppose. +If you care, you can use https, I suppose. If you do use https either for +all of the wiki, or just the cgi access, then consider using the sslcookie +option. ## XSS holes in CGI output diff --git a/doc/usage.mdwn b/doc/usage.mdwn index efbc765ac..4456e8c1c 100644 --- a/doc/usage.mdwn +++ b/doc/usage.mdwn @@ -227,6 +227,12 @@ configuration options of their own. Enable [[w3mmode]], which allows w3m to use ikiwiki as a local CGI script, without a web server. +* --sslcookie + + Only send cookies over an SSL connection. This should prevent them being + intercepted. If you enable this option then you must run at least the + CGI portion of ikiwiki over SSL. + * --getctime Pull last changed time for each new page out of the revision control |