Vanilla 1 is no longer supported or maintained. If you need a copy, you can get it here.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.
Forum - http, login - https
It's possible in Vanilla? I fight with code, but...
- Redirect from http to https - works.
- Authentication - works.
- Come back from https to https - works.
- PROBLEM - here (I think) appear problem with cookies or sessions vars.
Any idea how to resolve this problem without big changes in Vanilla Authenticator?
0
This discussion has been closed.
Comments
Public Wi-Fi even more insecure than previously thought.
Personally, I would do a second redirect to remove the random key from the address bar.
Speaking of Yahoo, they used to use a hash method that would workfor those without HTTPS certificates. Use a client-side md5 hash of the plaintext password hashed with some other random token.
Then the server validates that that is a valid FormPostBackKey, and hashes it with the already hashed value in the database.
example code (php .zip)
What exactly is your problem?