Hi Carlton, Many production systems, including mine, are using HTTPS, which effectively blocks the capability of attackers from sniffing other people's cookies.
Regards, Aldian Fazrihady On Wed, Apr 3, 2019 at 4:02 PM Carlton Gibson <carlton.gib...@gmail.com> wrote: > Hi all. > > https://code.djangoproject.com/ticket/30314 > > > Per the documentation, "Leaving this setting off isn’t a good idea > because an attacker could capture an unencrypted session cookie with a > packet sniffer and use the cookie to hijack the user’s session." > > > > If it's not a good idea for this setting to be off, why is it off by > default? Seems backwards to me. > > This looks right to me. A small breaking change for 3.0 would seem > reasonable. So I'm going to Accept this. > > BUT this has been this way forever > <https://github.com/django/django/commit/45be33a6327bccae60319982254ee62f65bea11e> > so > I just wanted to check if there were any overriding *Whys*? > > Thanks. > Carlton > > -- > You received this message because you are subscribed to the Google Groups > "Django developers (Contributions to Django itself)" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at https://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/e67ee6a2-751e-4b24-9d72-6c746a8c0178%40googlegroups.com > <https://groups.google.com/d/msgid/django-developers/e67ee6a2-751e-4b24-9d72-6c746a8c0178%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CAN7EoAZD5zYSQNqb13sJiaLsRNyFZhE9YREW%2B4hjUrC-TQp-HA%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
