Paths

Table of Contentst

Fix issue where accessing HTTP domain would override HTTPS cookie
ClosedPublic
Actions

Authored by hach-que on Feb 15 2014, 1:00 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Mon, Jan 20, 9:03 AM

	Unknown Object (File)
	Sat, Jan 18, 7:53 AM

	Unknown Object (File)
	Fri, Jan 17, 5:56 AM

	Unknown Object (File)
	Fri, Jan 17, 5:56 AM

	Unknown Object (File)
	Fri, Jan 17, 5:56 AM

	Unknown Object (File)
	Fri, Jan 17, 5:52 AM

	Unknown Object (File)
	Wed, Jan 1, 4:13 PM

	Unknown Object (File)
	Sat, Dec 28, 3:22 PM

Subscribers

Details

Reviewers

epriestley

Group Reviewers

Blessed Reviewers

Maniphest Tasks

T4425: Users are signed out if visiting HTTP when Phabricator is configured for HTTPS

Commits

Restricted Diffusion Commit
rP569a5be5617f: Fix issue where accessing HTTP domain would override HTTPS cookie

Summary

This fixes an issue where visiting http://code.redpointsoftware.com.au/ would log you out of https://code.redpointsoftware.com.au/

Test Plan

Applied this patch to a live server and saw the issue go away.

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

Hmm.. maybe it's cleaner for the PhabricatorRedirectController not to try to write this cookie? I think the simplest fix would be to extend it from AphrontController instead of PhabricatorController. I think it's executing a lot of logic which is at best useless and at worst bad (as here) by running through PhabricatorController::willBeginExecution().

I suppose this is probably worth having as a safety net in any case, since it's definitely correct, it's just a bit odd that we can end up here.

Closed by commit rP569a5be5617f (authored by @hach-que).

Revision Contents
Changeset List

Path

Size

src/

aphront/

AphrontRequest.php

5 lines

Diff 19616

View Options

src/aphront/AphrontRequest.php

Fix issue where accessing HTTP domain would override HTTPS cookieClosedPublicActions