Variable SSL and Cookies

Question

Let's say I have a membership site, and my login page & form are served with SSL: https://mysite.com/member/login.

<form action='https://mysite.com' method='post' class='login'>
    <!-- login form inputs -->
</form>

The user logs in and EE sets a cookie so she remains logged in. It also sets some other cookies to track some other stuff about her. But then the member navigates to my homepage which is not served over SSL: http://mysite.com/

Are the user's membership cookies now susceptible to being intercepted because they're not being sent over SSL? If they are intercepted, can they be used by a baddie to cause trouble on my site?

Ultimately, should any site with front-end membership functionality use SSL on every page, not just pages with sensitive data & forms?

Answer 1

Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original cookies were set using HTTPS/SSL and the current page is HTTP.

One way around this is by setting the "secure" flag on cookies you set. Any cookies set with the "secure" flag will only get transmitted by browsers when connecting to HTTPS pages. In recent versions of ExpressionEngine there are a few ways to do this. One way is by setting this config variable:

$config['cookie_secure'] = 'y';

That'll make sure all cookies set by EE get the secure flag (note: the server must be configured to set the HTTPS environment variable). If you only want to set it for some cookies, you can use the set_cookie_end extension hook to put custom logic around cookie requests, making the important ones secure.

Remember that if you use secure cookies for things like the session cookie, cart sessions, etc... those things won't persist in HTTP requests which might lead to some weird UX if you don't account for it in URLs and redirects.

As far as how much trouble bad actors can make with cookies, it depends. With some settings, ExpressionEngine will try to fingerprint session IDs with information like the user agent and other data. This can help because EE won't authenticate a session if the information doesn't match.

The safest approach is to operate over only HTTPS and set all cookies to secure (and HttpOnly, which EE now does as default). Hardware is very fast with SSL/TLS these days so unless you're running with a lot of traffic or on a complicated setup, you probably won't see much a performance issue.

Let me know if I can provide any other information on this!

Answer 2

.

Why NOT use SSL on every page is a good question? The extra server load is negligible, it makes things much simpler (not detect/re-direct etc) - and it makes the entire site look trustworthy. The main potential disadvantages are if you're using off site assets that are not served over SSL, which will give mixed content warnings.