Module Description
For sites that are available via both HTTP and HTTPS, Secure Login ensures that the user login and other forms are submitted securely via HTTPS, thus preventing passwords, authenticated session cookies, and other private user data from being transmitted in the clear.
Secure Login locks down not just the user/login page but also any page containing the user login block, and any other forms that you configure to be secured.
Secure Login enforces secure authenticated session cookies, thus preventing session hijacking by eavesdroppers.
Note that in current versions of Drupal, unlike Drupal 7, anonymous insecure session data is not migrated to an authenticated secure session upon login; instead, an empty secure session is created.
Drupal 7
Secure Login is intended for sites that want to offer anonymous sessions via HTTP or HTTPS and authenticated sessions only via HTTPS. Anonymous insecure sessions are migrated to authenticated secure sessions upon login, with all session data intact. Secure Login is designed to work with Drupal 7's $conf['https'] setting at its default value, FALSE.
If you were to change $conf['https'] to TRUE, you would enable mixed-mode (HTTPS and HTTP) authenticated sessions: both secure and insecure session cookies are set when a user logs in to the HTTPS site. Other contributed modules, such as Secure Pages, may assist you with implementing mixed-mode authenticated sessions.
Drupal 6
Prior to Drupal 7, PHP's session.cookie_secure flag must be enabled on the HTTPS site to enforce secure authenticated session cookies.
Pro tip: HSTS
To help protect against SSL stripping attacks, add the Strict-Transport-Security header in your webserver or Security Kit module configuration, and add your domain to the browser HSTS preload list.
Credits
Secure Login is developed and maintained by mfb, along with other contributors from the community. You can support development by sponsoring or contributing. 🔐👷
Secure Login locks down not just the user/login page but also any page containing the user login block, and any other forms that you configure to be secured.
Secure Login enforces secure authenticated session cookies, thus preventing session hijacking by eavesdroppers.
Note that in current versions of Drupal, unlike Drupal 7, anonymous insecure session data is not migrated to an authenticated secure session upon login; instead, an empty secure session is created.
Drupal 7
Secure Login is intended for sites that want to offer anonymous sessions via HTTP or HTTPS and authenticated sessions only via HTTPS. Anonymous insecure sessions are migrated to authenticated secure sessions upon login, with all session data intact. Secure Login is designed to work with Drupal 7's $conf['https'] setting at its default value, FALSE.
If you were to change $conf['https'] to TRUE, you would enable mixed-mode (HTTPS and HTTP) authenticated sessions: both secure and insecure session cookies are set when a user logs in to the HTTPS site. Other contributed modules, such as Secure Pages, may assist you with implementing mixed-mode authenticated sessions.
Drupal 6
Prior to Drupal 7, PHP's session.cookie_secure flag must be enabled on the HTTPS site to enforce secure authenticated session cookies.
Pro tip: HSTS
To help protect against SSL stripping attacks, add the Strict-Transport-Security header in your webserver or Security Kit module configuration, and add your domain to the browser HSTS preload list.
Credits
Secure Login is developed and maintained by mfb, along with other contributors from the community. You can support development by sponsoring or contributing. 🔐👷
Module Link
Project Usage
7899
Security Covered
Covered By Security Advisory
Version Available
Production
Module Summary
Secure Login module ensures that user login and other forms are submitted securely via HTTPS, preventing private user data from being transmitted in the clear.
Data Name
securelogin
OPENAI CHATBOT
OPENAI CHATBOT
