{"action":"opened","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/11367","repository_url":"https://api.github.com/repos/yiisoft/yii2","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/11367/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/11367/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/11367/events","html_url":"https://github.com/yiisoft/yii2/issues/11367","id":148861884,"number":11367,"title":"Add TLS as Best Practice to the Guide","user":{"login":"tom--","id":1178722,"avatar_url":"https://avatars.githubusercontent.com/u/1178722?v=3","gravatar_id":"","url":"https://api.github.com/users/tom--","html_url":"https://github.com/tom--","followers_url":"https://api.github.com/users/tom--/followers","following_url":"https://api.github.com/users/tom--/following{/other_user}","gists_url":"https://api.github.com/users/tom--/gists{/gist_id}","starred_url":"https://api.github.com/users/tom--/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tom--/subscriptions","organizations_url":"https://api.github.com/users/tom--/orgs","repos_url":"https://api.github.com/users/tom--/repos","events_url":"https://api.github.com/users/tom--/events{/privacy}","received_events_url":"https://api.github.com/users/tom--/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-16T15:20:03Z","updated_at":"2016-04-16T15:20:03Z","closed_at":null,"body":"Yii 2 provides features that rely on cookies and/or PHP sessions. These can be vulnerable. The vulnerability is reduced if the app runs on TLS.\r\n\r\nHence I suggest the mos def guide's page on Best Practices should have another heading to explain that if the app uses these features of Yii, it should run the app over TLS.\r\n\r\nThis section could usefully also point to an external resource for finding up-to-date information on configuring TLS, perhaps h5bp."}}