substack/ploy — pull request #15 by natesilva (2013-09-03 14:50:47+00:00)
Title: enable honorCipherOrder to fix BEAST vulnerability

When using SSL/TLS, `ploy` should set `honorCipherOrder` to `true`.

Without this, SSL/TLS connections are vulnerable to the BEAST attack. Setting this to `true` is recommended in the [docs](http://nodejs.org/api/tls.html#tls_tls_createserver_options_secureconnectionlistener).

With this change, running an [SSL Labs test](https://www.ssllabs.com/ssltest/) against a `ploy` site, the score goes from “B” to “A”.

Note: There’s another issue with SSL/TLS support, and that is forward secrecy. Unfortunately Node as of 0.10.17 doesn’t support this. The good news is, once the fix makes it into Node, it will probably be fixed automatically for `ploy` and other apps.