Skip to content
This repository has been archived by the owner on Dec 14, 2018. It is now read-only.

CookieTempDataProvider hard codes cookie to be secure-only, thus requiring HTTPS to function #5511

Closed
DamianEdwards opened this issue Nov 8, 2016 · 1 comment
Closed

CookieTempDataProvider hard codes cookie to be secure-only, thus requiring HTTPS to function #5511

DamianEdwards opened this issue Nov 8, 2016 · 1 comment
Assignees
@kichalla
Labels
3 - Done bug
Milestone
1.1.0

Comments

@DamianEdwards
Copy link
Member

https://github.com/aspnet/Mvc/blob/dev/src/Microsoft.AspNetCore.Mvc.ViewFeatures/ViewFeatures/CookieTempDataProvider.cs#L69

The cookie should only be marked secure if the incoming request is itself HTTPS. As it stands, this feature cannot be used unless the site is protected with HTTPS.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@kichalla kichalla

Labels
3 - Done bug
Projects
None yet
Milestone
1.1.0
Development

No branches or pull requests
3 participants
@Eilon @DamianEdwards @kichalla