Maniphest T119576

Mark cookies from varnish as secure
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Nov 24 2015, 10:57 PM

Description

GeoIP and WMF-Last-Access cookies come from Varnish. We should be marking them as secure!

Details

	Subject	Repo	Branch	Lines +/-
	secure CP cookie	operations/puppet	production	+2 -2
	secure WMF-Last-Access cookie	operations/puppet	production	+2 -2

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open		None	T119570 Consider setting "Secure" on cookies that EFF HTTPS-Everywhere sets this on for us (tracking)
		Resolved		BBlack	T119576 Mark cookies from varnish as secure

Event Timeline

Reedy created this task.Nov 24 2015, 10:57 PM

Reedy raised the priority of this task from to Needs Triage.

Reedy updated the task description. (Show Details)

Reedy added projects: HTTPS, Varnish.

Reedy added subscribers: Krenair, Aklapper, csteipp and 2 others.

Dzahn moved this task from Backlog to Cookies on the HTTPS board.Dec 3 2015, 7:11 PM

Aklapper added a project: Traffic.Feb 23 2016, 6:12 PM

Restricted Application added a project: SRE. · View Herald TranscriptFeb 23 2016, 6:12 PM

Change 281979 had a related patch set uploaded (by BBlack):
secure WMF-Last-Access cookie T119576

https://gerrit.wikimedia.org/r/281979

Change 281980 had a related patch set uploaded (by BBlack):
secure GeoIP cookie T119576

https://gerrit.wikimedia.org/r/281980

Note there are probably question-marks around these about insecure requests. We don't yet block/deny insecure POST traffic ( T105794 ), but we've been warning about it and trying to weed them out from top log entries for a long time now, and sending warnings on the API requests. This could break requests which currently send these two cookies along with an insecure POST , but IMHO we're well past the date range where we can say "Hey, fix your insecure POST traffic instead of complaining about the broken cookies"

Change 281980 merged by BBlack:
secure GeoIP cookie T119576

https://gerrit.wikimedia.org/r/281980

Change 281979 merged by BBlack:
secure WMF-Last-Access cookie T119576

https://gerrit.wikimedia.org/r/281979

BBlack closed this task as Resolved.Apr 7 2016, 7:05 PM

BBlack claimed this task.

BBlack merged a task: T105451: WMF-Last-Access cookies doesn't set Secure flag.Apr 12 2016, 4:29 PM

BBlack added subscribers: • MZMcBride, faidon, ori and 2 others.

Change 284110 had a related patch set uploaded (by BBlack):
secure WMF-Last-Access cookie

https://gerrit.wikimedia.org/r/284110

Change 284111 had a related patch set uploaded (by BBlack):
secure CP cookie

https://gerrit.wikimedia.org/r/284111