Errors with XC5 Cookie settings when an XC5 store is HTTPS only
All of our store setups are 100% https only and have been since day 1 with XC5. On the server side, this is via permanent SEO-safe 301 redirects from HTTP to HTTPS but also, the XC5 https://*.*/admin.php?target=https_settings page and Redirect customers to HTTPS flag is set to YES. All of this is fine, it works and there's no issues here. The small issue is the XC5 cookie setting...
If the Redirect customers to HTTPS flag is set to YES by Admin, then by default, the XC5 cookie should include a Secure flag designed to protect cookies against their accidental transmission over HTTP. Okay, it's technically impossible in our case, especially with HSTS in place too...but the lack of the Secure flag in the cookie is brought up as an error, on every single test site you may care to use. This is correct as it's contradictory in terms of setup flags. This doesn't impede trading, but as far as we can see, this hasn't already been noticed / tested / added previously by XC 8O so technically it's another very small bug, but moving forward positively, why can't this simply be added in the next XC5 upgrade? Especially as all other cookie directives have been comfortably met by XC5 already and have been for some time now (see below) Quote:
|
Re: Errors with XC5 Cookie settings when an XC5 store is HTTPS only
I've forwarded this information to the XC5 dev team.
|
Re: Errors with XC5 Cookie settings when an XC5 store is HTTPS only
Quote:
We've checked it, double checked it, independently tested it and it's all good. |
All times are GMT -8. The time now is 09:45 PM. |
Powered by vBulletin Version 3.5.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.