Sitecore with requireSSL for cookies

Question

Our site Sitecore 6.6.0 (rev. 120918) can work through http, as well as https. We also have a security requirement for all cookies to be transmitted over SSL, regardless of whether the website is accessible via http.

We achieved this requirement by using the requireSSL property in web.config, as described here: How to set a security flag in an ASP.NET session cookie?

Our public website works perfectly with this change, and when it is analyzed by Firebug, we see that all cookies are "safe" even when the website is accessed via http.

But the problem is that I try to enter the sitecore administration portal via http, it throws an error The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL. The application is configured to issue secure cookies. These cookies require the browser to issue the request over SSL (https protocol). However, the current request is not over SSL. . The only way to access the sitecore administration portal is through https. Even with https this gives some weird problems. After some time of use, he says that many user administrators are logged in, and I have to kick some of them out to log in. I also cannot access the admin portal remotely.

Why does a public website work with SSL files, but the sitecore administration portal has problems with SSL cookies. Is this possible and incompatible configuration on our site?

Answer 1

I think the problem is that you set up <httpCookies requireSSL="true" /> , which will set cookies for protection, but should also set forms authentication:

 <system.web> <forms requireSSL="true"> /* forms content */ </forms> </system.web> 

Since this will change the cookie setting. The problem is that this set in the forms section requires the login to happen on https, not on http. On a public website you will only see this problem if there is a login form.

To fix this, you will have to either enable SSL for your authoring system (which is recommended anyway) or not use secure cookies.

MSDN: property FormsAuthentication.RequireSSL

Answer 2

Based on the error message, I assume that the login is trying to set a cookie with a protected attribute when the connection is unsafe. This, of course, would be successful if the request was already secure.

As a workaround, you can use IIS rewrite to redirect the / sitecore request to SSL before all cookies are set up, as I assume you want all SSL requests for content management to be executed.

I can also be completely wrong :)