The "WMF-Last-Access" cookie is not secure now. Although HSTS is enabled, Secure flag is still needed, since old browsers don't support HSTS, and it is possible for users to clear the HSTS records without clearing cookies.
About WMF-Last-Access: https://wikitech.wikimedia.org/wiki/Analytics/Unique_clients/Last_access_solution
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Add "Secure" flag to GeoIP cookie | operations/puppet | production | +1 -1 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | BBlack | T104681 HTTPS Plans (tracking / high-level info) | |||
| Duplicate | None | T105451 WMF-Last-Access cookies doesn't set Secure flag |
Change 224029 had a related patch set uploaded (by Chmarkine):
Secure GeoIP and WMF-Last-Access cookies
Change 224029 abandoned by Chmarkine:
Add "Secure" flag to GeoIP cookie
Reason:
I agree now. I neglected the fact that a MITM can obtain the user's location by looking up his the victim's IP address directly.
This seems fairly straightforward to do, so I've tagged this task with the good first task keyword accordingly. If this is mistaken, please feel free to revert.