search

kyprizel / testcookie-nginx-module

simple robot mitigation module using cookie based challenge/response technique. Not supported any more.
http://kyprizel.github.com/testcookie-nginx-module/
524 stars 139 forks source link

Subdomains #23

Closed Fr3DBr closed 9 years ago

Fr3DBr commented 9 years ago

Hi, why subdomains, results in a different cookie hash ? (You can't access resources from different domains like : test.com/index.php trying to access content from subdomain.test.com/test2.php).

Fr3DBr commented 9 years ago

I found out why, this is because we used this parameter :

testcookie_secret random;

After setting a fixed key, it works.

Seems like the key is generated 'per vhost', it would be better if it was a global key :)