NuGet/NuGetGallery — pull request #825 by anurse (2013-02-26 01:43:36+00:00)
Title: All Auth cookies have to be secure

Fixes #667

We now drop two cookies when SSL is required and a user logs in: ASPXFORMSAUTH (Secure & HTTP Only) and ForceSSL (Non-Secure). The former is the forms auth token, the latter is a marker which tells us that there should be a forms auth token. The idea here is that if a user is logged in and navigates to an HTTP url, we see the ForceSSL cookie and redirect over to SSL in order to get their token. This means you don't seem to auto-logout just because you click an HTTP link, you just get redirected over to SSL.

Anything that goes through MVC gets this (it's a global action filter). OData does NOT but is read-only and thus does not need authentication. The actual API used to download has this feature but doesn't require authentication so this shouldn't affect pulls.

IMPORTANT: This will block HTTP-based pushing of packages. We need to verify that the client puts out a good error message (we return a 403 Forbidden with a message indicating SSL is required).

Still to come: Changes to CSDEF/CSCFG/etc.