Improve cookie encryption about snuffleupagus HOT 5 CLOSED

Can I pop in a suggestion to let the system variable you look in for the IP be configurable? In our setup, since we're behind load balancers (with re-negotiated SSL), REMOTE_ADDR is the LB address. Thus in your setup, the IP address would have no variation between users.

from snuffleupagus.

I'm not sure that using the SSL_SESSION_ID is a good idea :

• It is transient, if the server or the client reboots, it's gone (but the same thing can be said about an IP address)
• If the application is hosted behind a reverse proxy, all clients will share the same SSL_SESSION_ID as the ssl connection is negotiated between the RP and the web server
• What about websites that don't use SSL ? (i know it's 2017, but i'll bet that the websites that need snuffleupagus the most don't use SSL)

from snuffleupagus.

People are less likely to reset their TLS session than to move to an other IP thanks to roaming. For the reverse-proxy, we do have the same issue with our current IP-based approach: the server will see the IP of the RP, except if the users configures it properly, leading to point 3: we can always fallback to using our current solution :)

from snuffleupagus.

Except it is way easier to setup mod_rpaf so that the server will see the client IP than trying to forward the SSL_SESSION_ID :)

from snuffleupagus.

This is done in 377cb2a

Thank everyone for the suggestions ♥

from snuffleupagus.