alphagov/whitehall — pull request #33 by bradleywright (2012-09-04 12:09:34+00:00)
Title: Make session cookie HTTPS only in !dev/test environments

One of the outcomes of security auditing was that our session cookie is vulnerable to man in the middle/session replay attacks because it's not HTTPS only. This change makes the session initializer (sic) enable HTTPS-only cookies in non test/dev situations.