undefined | Better HN

0 pointsoxplot5y ago0 comments

That only protects the user's password. The auth cookie will be sent in all subsequent requests in plain text.

EDIT: that's how firesheep (https://en.wikipedia.org/wiki/Firesheep) hijacked sessions for e.g.

0 comments

1 comments · 1 top-level

nly5y ago

That's not true. Cookies can have a 'secure' attribute which tells the browser to send them only over TLS

j / k navigate · click thread line to collapse