Change the default value of $CookieSecure to 1.
#2658
Conversation
There is really no production scenario where this should be anything but 1. If you are really serving without https, then you can change this. And good luck dealing with your users having to click through the warnings to get to your site. Note that this just works if you are using `localhost` in development also. Browsers have a built in exception for `localhost` and consider it secure without actual certificates. I am tired of seeing forum issues because system administrators forget or don't know to change this.
|
I think it is worth adding a note. I almost did but for some reason held off. I guess I wasn't sure exactly what to say other than "Don't do this." |
|
Historically there have been quite a few instances of webwork that were served without SSL, and we have lots of notes in the installation manual and such about "if you are serving with https...". Nowadays, serving without SSL even for the most basic of sites is something you really just can't do anymore. |
|
The only use case I see is for disabling this is test/dev environments. That's why I suggested saying something about not changing it on production systems. |
|
Oops, I missed you were complicating adding an additional note. I was mostly thinking you were discussing updating install instructions and adding notes there. |
|
That is okay. We can add a note later. I think that most will just leave this as it is. |
There is really no production scenario where this should be anything but 1. If you are really serving without https, then you can change this. And good luck dealing with your users having to click through the warnings to get to your site.
Note that this just works if you are using
localhostin development also. Browsers have a built in exception forlocalhostand consider it secure without actual certificates.I am tired of seeing forum issues because system administrators forget or don't know to change this.