[Savannah-dev] [Bug #1399] Problems with login cookies: don't work with http, only https

[nobody]

=================== BUG #1399: LATEST MODIFICATIONS ==================
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=1399&group_id=11

Changes by: Mathieu Roy <address@hidden>
Date: 2002-Oct-11 19:13 (Europe/Paris)

            What     | Removed                   | Added
---------------------------------------------------------------------------
          Resolution | None                      | Works for me




=================== BUG #1399: FULL BUG SNAPSHOT ===================


Submitted by: psmith                    Project: Savannah                       
Submitted on: 2002-Oct-11 18:42
Category:  PHP Engine                   Severity:  5 - Average                  
Priority:  None                         Bug Group:  None                        
Resolution:  Works for me               Assigned to:  yeupou                    
Status:  Open                           Effort:  0.00                           

Summary:  Problems with login cookies: don't work with http, only https

Original Submission:  After I log in to Savannah, I have a cookie (I assume) 
that remembers my login.  This is fine with one problem: it only seems to be 
available if I use the https (SSL) connection.  If I type in a URL like 
http://savannah.gnu.org then my login is lost.  It would be nice if the cookie 
could be available even for non-SSL connections, since most of my bookmarks, 
etc. use simple http://...

If that can't be done, please modify the URLs that the trackers send out to use 
https://... instead of http://... so that when I get a new bug announcement I 
can click on the link and when it comes up in my browser it's using my existing 
login, rather than my having to edit the URL in the browser box to add the "s" 
to make it https://...  Note that it's fine to connect with https://... 
addresses even if you're not logged in; it works the same.

Follow-up Comments
*******************

-------------------------------------------------------
Date: 2002-Oct-11 19:13             By: yeupou
Cookies are set for the domain name, whatever the connection is secured or not. 
This is strange.

Can you give details about the browser you are using? 


Also, note that when you are on a page with https, all the links should begin 
with https. If not, it's a bug. If you find a bug like this, please give us 
pointers to the concerned pages.


CC list is empty


No files currently attached


For detailed info, follow this link:
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=1399&group_id=11