I faced issues, in which the remember me plugin did not work properly.
Login in Joomla Site, check "remember me" checkbox. Wait until the session expires.
User is logged in independent of port (SSL/no-SSL).
If you log in in SSL and switch over to non-SSL, you are not logged in after the expiration of the session.
PHP-Version 5.4.36-0+deb7u3
Webserver nginx/1.2.1
PHP-Interface for the webserver fpm-fcgi
Joomla!-Version Joomla! 3.4.0 Stable [ Ember ] 24-February-2015 23:00 GMT
Joomla!-Plattform-Version Joomla Platform 13.1.0 Stable [ Curiosity ] 24-Apr-2013 00:00 GMT
I worked out a patch, which works independently of the server port.
Open: /plugins/authentication/cookie/cookie.php
Function to edit: onUserAfterLogout
Before:
$this->app->input->cookie->set(
$cookieName, $cookieValue,
time() + $lifetime,
$this->app->get('cookie_path', '/'),
$this->app->get('cookie_domain'),
$this->app->isSSLConnection()
);
After:
$this->app->input->cookie->set(
$cookieName, $cookieValue,
time() + $lifetime,
$this->app->get('cookie_path', '/'),
$this->app->get('cookie_domain'),
false
);
Open: /libraries/joomla/user/helper.php
Function to edit: getShortHashedUserAgent
Before:
return md5(JUri::base() . $uaShort);
After:
return md5($_SERVER['SERVER_NAME'] . $uaShort);
This solution works independent of using http/https. I can do a PR if you think this change is reasonable.
Labels |
Removed:
?
|
Labels |
Added:
?
|
I agree with @Bakual - for me this is expected behavior. Why? Because it has a security impact:
If a site uses SSL, an attackers is unable to extract the remember-me cookie from the traffic and login as the victim because the traffic is encrypted.
But if an attackers forces the victim to use HTTP instead of HTTPS, the cookie is transferred in plain text and therefore can be extracted and misused.
So, I would consider this a feature, not a bug ;)
Status | New | ⇒ | Expected Behaviour |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-03-15 15:31:18 |
Closed_By | ⇒ | zero-24 |
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-03-15 15:31:19 |
Set to "closed" on behalf of @zero-24 by The JTracker Application at issues.joomla.org/joomla-cms/6436
Closing based on feedback by @Bakual and @SniperSister
Imho, it's actually correct that a login cookie which is set using https doesn't work when using http only.