{"action":"created","issue":{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/14420","repository_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin","labels_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/14420/labels{/name}","comments_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/14420/comments","events_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/14420/events","html_url":"https://github.com/phpmyadmin/phpmyadmin/pull/14420","id":335055653,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk2ODczMDI2","number":14420,"title":"Proposal to fix HTTPS/HTTP cookie separation issue","user":{"login":"williamdes","id":7784660,"node_id":"MDQ6VXNlcjc3ODQ2NjA=","avatar_url":"https://avatars0.githubusercontent.com/u/7784660?v=4","gravatar_id":"","url":"https://api.github.com/users/williamdes","html_url":"https://github.com/williamdes","followers_url":"https://api.github.com/users/williamdes/followers","following_url":"https://api.github.com/users/williamdes/following{/other_user}","gists_url":"https://api.github.com/users/williamdes/gists{/gist_id}","starred_url":"https://api.github.com/users/williamdes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/williamdes/subscriptions","organizations_url":"https://api.github.com/users/williamdes/orgs","repos_url":"https://api.github.com/users/williamdes/repos","events_url":"https://api.github.com/users/williamdes/events{/privacy}","received_events_url":"https://api.github.com/users/williamdes/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-23T01:16:59Z","updated_at":"2018-08-06T00:25:53Z","closed_at":"2018-07-21T15:21:49Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/pulls/14420","html_url":"https://github.com/phpmyadmin/phpmyadmin/pull/14420","diff_url":"https://github.com/phpmyadmin/phpmyadmin/pull/14420.diff","patch_url":"https://github.com/phpmyadmin/phpmyadmin/pull/14420.patch"},"body":"I am trying to fix the issue with login.\r\n**This PR fixes 1/2 of the issue.**\r\n\r\n@ibennetch @nijel @mauriciofauth I want to separate cookie names like in screenshot, please _approve_ or not the proposal code of this PR :)\r\n\r\nTests are failing, I will correct them if this PR seems OK for you.\r\n\r\n![It works !](https://user-images.githubusercontent.com/7784660/41804256-7420af40-7693-11e8-83b3-21d82c90022e.jpg)\r\n\r\n\r\nSee issue #14184\r\n- REPO: https://github.com/williamdes/issue-14184-pma-login\r\n\r\n### Follow instructions below\r\nDo the following :\r\n- Open a **private browser**\r\n- Login on **https** version\r\n- It works !\r\n- Login on **http** version\r\n- Does not work\r\n- **Close the browser**\r\n- Open a **private browser**\r\n- Login on **http** version\r\n- It works !\r\n- Login on **https** version\r\n- It works !\r\n\r\nThis is exactly what happens on phpMyAdmin (excluding the cookie token/expire bug).\r\n\r\n### RTFM\r\n```\r\n4.1.2.5.  The Secure Attribute\r\n\r\n   The Secure attribute limits the scope of the cookie to \"secure\"\r\n   channels (where \"secure\" is defined by the user agent).  When a\r\n   cookie has the Secure attribute, the user agent will include the\r\n   cookie in an HTTP request only if the request is transmitted over a\r\n   secure channel (typically HTTP over Transport Layer Security (TLS)\r\n   [RFC2818]).\r\n\r\n   Although seemingly useful for protecting cookies from active network\r\n   attackers, the Secure attribute protects only the cookie's\r\n   confidentiality.  An active network attacker can overwrite Secure\r\n   cookies from an insecure channel, disrupting their integrity (see\r\n   Section 8.6 for more details).\r\n```\r\n> The Secure attribute **limits the scope** of the cookie to \"secure\"\r\n   channels\r\n\r\n> the user agent will include the\r\n   cookie in an HTTP request **only** if the request is transmitted over a\r\n   **secure channel**\r\n\r\n> An active network attacker can **overwrite Secure\r\n   cookies from an insecure channel**\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/comments/410559559","html_url":"https://github.com/phpmyadmin/phpmyadmin/pull/14420#issuecomment-410559559","issue_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/14420","id":410559559,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDU1OTU1OQ==","user":{"login":"ibennetch","id":1443710,"node_id":"MDQ6VXNlcjE0NDM3MTA=","avatar_url":"https://avatars1.githubusercontent.com/u/1443710?v=4","gravatar_id":"","url":"https://api.github.com/users/ibennetch","html_url":"https://github.com/ibennetch","followers_url":"https://api.github.com/users/ibennetch/followers","following_url":"https://api.github.com/users/ibennetch/following{/other_user}","gists_url":"https://api.github.com/users/ibennetch/gists{/gist_id}","starred_url":"https://api.github.com/users/ibennetch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ibennetch/subscriptions","organizations_url":"https://api.github.com/users/ibennetch/orgs","repos_url":"https://api.github.com/users/ibennetch/repos","events_url":"https://api.github.com/users/ibennetch/events{/privacy}","received_events_url":"https://api.github.com/users/ibennetch/received_events","type":"User","site_admin":false},"created_at":"2018-08-06T00:25:53Z","updated_at":"2018-08-06T00:25:53Z","author_association":"MEMBER","body":"@williamdes Do you have another pull request in place to replace this one? Seems like you made good progress towards solving this and I'd love to be able to merge a fix in to master."}}
{"actor":{"display_login":"ibennetch"}}