[jira] [Resolved] (SHIRO-409) Need a nossl to match the ssl filter

["Les Hazlewood (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SHIRO-409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Les Hazlewood resolved SHIRO-409.
---------------------------------

    Resolution: Won't Fix

The scenario you describe suffers from Session Hijacking attacks (http://en.wikipedia.org/wiki/Session_hijacking).  Once a user logs in over SSL, if cookies or tokens are to be subsequently exchanged, you should _never_ drop down to non-SSL until the session expires or the user logs out.

The Shiro development team cannot incorporate this into the codebase, as it would implicitly accept/advocate a well-known security exploit scenario.

I'm happy to re-open the issue of course if you can present a scenario where this can still be secure - I don't know much about your particular use case, so maybe additional information could be presented where this would still make sense.
                
> Need a nossl to match the ssl filter
> ------------------------------------
>
>                 Key: SHIRO-409
>                 URL: https://issues.apache.org/jira/browse/SHIRO-409
>             Project: Shiro
>          Issue Type: New Feature
>          Components: Authentication (log-in)
>    Affects Versions: 1.2.1
>         Environment: All
>            Reporter: Kamal Sharif
>            Priority: Critical
>              Labels: features
>
> One great-but not seemingly too difficult- feature would be a nossl filter to match the ssl filter. In my website, I only want the login process to be handled over https, but using ssl filter, the site stays in https since all of the links on those pages will stay relative to the https url.
> It would be great if a nossl filter exisited that one could define and would switch the port for the urls defined.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira