8

I'm setting up a magento website but one thing i've noticed is https can be used only for secure content such as login pages and account details etc.

This means on product pages regular http is used.

Doesn't this mean the cookie transmitted over http is vulnerable to be stolen by any cookie sniffing program?

Or does Magento handle these pages by not sending a cookie and getting the default page and then using a local cookie to change the header to contain the custom name and profile picture etc.

6

https is only required on pages that submit data like the checkout page for example. Still, using a https URL for unsecure base url wouldn't hurt

If you're worrying about people stealing cookies (session hijacking) go to System > Configuration > Web > Session Validation Settings and enable Validate REMOTE_ADDR

[EDIT] - Credits to @AnnaVölkl

  • so if you transfer the cookie both via HTTP and HTTPS, it's pretty easy to steal
  • if you set the cookie to HTTPS only (the standard PHP setcookie method has the $secure flag, you will loose the session when switching from http to https. but it's safe of course.

Use HTTP Only Determines if Magento Cookies can be used only over an unsecure channel (http), or can also be used over an encrypted channel (https). Options include: Yes / No

there's no reason to not use https accross the whole website any more: https://istlsfastyet.com

  • Thank for the response, could you explain what this does? – Gareth Aug 27 '15 at 15:05
  • It checks if the session ID in the cookie matches a stored session + the users IP address that was stored with this session. So for me to steal your cookie value wouldn't work without also having your IP – Sander Mangel Aug 27 '15 at 15:08
  • So this would protect against cookie theft across networks but not on a public one. Is there any way to prevent this on a public network without full https across the site – Gareth Aug 27 '15 at 15:14
  • I think you're right but I'm not sure. I've asked someone else to help me out :) – Sander Mangel Aug 27 '15 at 15:24
  • 1
    @Gareth I've updated the answer with help from Anna :) – Sander Mangel Aug 28 '15 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.