Hi.

Love this module.

I'm not sure if this is outside of the scope of the module, but I'm just curious - why not also enforce secure logins by implementing hook_user_login and logging out any non-ssl sessions?

Currently, if the user mucks with the form using firebug, etc, they can still log in and have a non-ssl session (I was able to in the d7 version).

Thanks.

Comments

captainack created an issue. See original summary.

mfb’s picture

mfb
they or he
commented
Issue summary: View changes

It's correct that logins forced over HTTP do work. hook_user_login() is invoked after login so technically speaking this doesn't prevent login, it just allows us to log the user out as you mention. Another possibility would be interrupting the post submission with a redirect as in #2454599: Allow to redirect POST requests to https

mfb’s picture

mfb
they or he
commented
Status: Active » Fixed

via #2454599: Allow to redirect POST requests to https POST requests are now redirected to HTTPS if the redirect setting is enabled.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.