Project: moodle
Issue MDL-42834: Deprecate loginhttps
In my opinion, it's about time we deprecated and removed the loginhttps config setting and sealed this potential leak. It was removed from Mahara over three years ago (https://bugs.launchpad.net/mahara/+bug/646713) for two primary reasons: * it broke AJAX login; and * there can be times where an http link is present on an https page. In Moodle we don't have AJAX login, and we have mitigated against the https -> http issue by always setting the wwwroot to the current schema. However, it would be really super nice if we *could* have AJAX login, and I don't feel that the reasons which once prevented forced use of HTTPS throughout a site are as strong as they used to be. Hardware performance is far better than it was five years ago; it's been [proven how easy it is to steal sessions from non-ssl|http://en.wikipedia.org/wiki/Firesheep] so these things are no longer theoretical or even hard; and SSL is far more widespread. As it is, we already load all additional content (e.g. CSS, JS, image) over SSL so it's now just the actual page content which is not. We no longer have issues with third-party plugins not supporting SSL (e.g. YouTube, Vimeo, etc). I'd like to propose that we drop support for loginhttps. (more documentation changes: http://docs.moodle.org/27/en/Apache)
Story points: 40