0

Session cookies are quickly becoming a standard way of doing login management. However, if sent unencrypted, it's pretty easy to hijack someone's session ala Firesheep.

Now, you can solve this by making your entire site use HTTPS, but if someone types in mysite.com the browser defaults to http. We can solve this with a redirect:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

But by the time I get a chance to rewrite the URL, hasn't my session cookie already been sent over an insecure channel?

2
  • I suppose it can depend on what language you are using to power your site. Assuming you are using Apache and PHP, the answer is no, your Rewrite will run before PHP is started and a PHP session (id) generated. Dec 18, 2010 at 23:55
  • Yeah, the only problem is finding some way to prevent the client from sending a session cookie that it already has.
    – Ender
    Dec 19, 2010 at 0:05

1 Answer 1

2

Mark your session cookie as HTTPS-only using the Secure option.

3
  • 1
    The Http-Only setting is also another thing to turn on because it prevents JavaScript from accessing it in the cookies collection. useful for guarding against XSS.
    – vcsjones
    Dec 18, 2010 at 23:54
  • Happily, it seems that there's a PHP option for this: us.php.net/manual/en/…
    – Ender
    Dec 18, 2010 at 23:58
  • ...and one for Http-Only too: us.php.net/manual/en/… :D
    – Ender
    Dec 18, 2010 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.