When using the functionality where the system admin can log in as any user, I noticed that during log-out, there are two different responses that I can get back from /secur/logout.jsp. The most common one conveniently takes me back to the user page, but there is one that logs me out, and causes the browser to generate a warning since it tries to run javascript to submit a form to the root url over plain http.

I grabbed the sid from the request cookies, and an attempt at a rest api request about a minute later showed the session id had already been invalidated at that point at least, but this warning message still makes me a little uneasy. Are there any security concerns with clicking continue and sending that request without TLS?

Occasional response that logs me out and javascript-redirects over http

enter image description here

Typical response that takes me back to the user page

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.