HTTP security - Versionshistorik

Leonstr: Changed to indented


2022-07-05T16:06:34Z
Changed <code php> to indented <pre>

				
				
				
				
				
				← Äldre version
				Versionen från 5 juli 2022 kl. 16.06
				
Rad 11:
Rad 11:
This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254): This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254):



<code php>  127.0.0.1
127.0.0.1  192.168.0.0/16
192.168.0.0/16  10.0.0.0/8
10.0.0.0/8  172.16.0.0/12
172.16.0.0/12  0.0.0.0
0.0.0.0  localhost
localhost  169.254.169.254
169.254.169.254  0000::1
0000::1 
</code> 



In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details. In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.
Rad 30:
Rad 28:
This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows: This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows:



<code php>  80
80  443
443 
</code> 



In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details. In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.



Michaelh2 den 13 april 2021 kl. 06.01
2021-04-13T06:01:04Z


				
				
				
				
				
				← Äldre version
				Versionen från 13 april 2021 kl. 06.01
				
Rad 6:
Rad 6:



It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

==cURL blocked hosts list==

This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254):

<code php>
127.0.0.1
192.168.0.0/16
10.0.0.0/8
172.16.0.0/12
0.0.0.0
localhost
169.254.169.254
0000::1
</code>

In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

'''Note:''' In addition to configuring this at the application level via this setting, it is also recommended that sufficient firewall/network security measures are in place, including restricting access to internal network endpoints to those users/services that require them.

==cURL allowed ports list==

This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows:

<code php>
80
443
</code>

In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

'''Note:''' In addition to configuring this at the application level via this setting, it is also recommended that sufficient firewall/network security measures are in place, including restricting access to open ports on the internal network to those users/services that require them.



==See also== ==See also==



Marycooch: MDL-42834
2017-11-10T15:52:22Z
MDL-42834

				
				
				
				
				
				← Äldre version
				Versionen från 10 november 2017 kl. 15.52
				
Rad 1:
Rad 1:
{{Security}} {{Security}}
In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS. *In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed.
* There is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.



==Secure cookies only== ==Secure cookies only==



Tsala: spacing
2017-11-09T16:28:08Z
spacing

				
				
				
				
				
				← Äldre version
				Versionen från 9 november 2017 kl. 16.28
				
Rad 1:
Rad 1:
{{Security}} {{Security}}

In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS. In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.






Tsala: loginhttps setting removed (MDL-42834)
2017-11-09T16:27:44Z
loginhttps setting removed (MDL-42834)

				
				
				
				
				
				← Äldre version
				Versionen från 9 november 2017 kl. 16.27
				
Rad 1:
Rad 1:
{{Security}} {{Security}}
[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''. 



==HTTPS for logins (deprecated - don't use)== In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.
[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server. 
  
It is not recommended that you use this setting as it's not secure despite using HTTPS for logins. Instead, please look at [[Transitioning to HTTPS]] completely 
  
You are also unable to use the SSL proxy setting at the same time 



==Secure cookies only== ==Secure cookies only==
Rad 16:
Rad 10:



* MDL-55662 for removing the secure cookies only setting * MDL-55662 for removing the secure cookies only setting

Forum discussions: 
*[http://moodle.org/mod/forum/discuss.php?d=79110 Locked out] 
*[https://moodle.org/mod/forum/discuss.php?d=339129 Secure Cookies] 



[[Category:Site administration]] [[Category:Site administration]]



Johnok: Deprecate loginhttps
2017-09-06T03:18:37Z
Deprecate loginhttps

				
				
				
				
				
				← Äldre version
				Versionen från 6 september 2017 kl. 03.18
				
Rad 2:
Rad 2:
[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''. [https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.



==Use HTTPS for logins== ==HTTPS for logins (deprecated - don't use)==
[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server. [https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.



It is not recommended that you use this setting as it's not secure despite using HTTPS for logins. It is not recommended that you use this setting as it's not secure despite using HTTPS for logins. Instead, please look at [[Transitioning to HTTPS]] completely



You are also unable to use the SSL proxy setting at the same time You are also unable to use the SSL proxy setting at the same time



Germanvaleroelizondo: Added wikipedia link to [https://en.wikipedia.org/wiki/HTTPS HTTPS]
2017-08-04T14:07:27Z
Added wikipedia link to [https://en.wikipedia.org/wiki/HTTPS HTTPS]

				
				
				
				
				
				← Äldre version
				Versionen från 4 augusti 2017 kl. 14.07
				
Rad 1:
Rad 1:
{{Security}} {{Security}}
HTTPS for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''. [https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.



==Use HTTPS for logins== ==Use HTTPS for logins==
HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server. [https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.



It is not recommended that you use this setting as it's not secure despite using HTTPS for logins. It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.
Rad 11:
Rad 11:
==Secure cookies only== ==Secure cookies only==



It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.



==See also== ==See also==



Tsala: page update
2017-08-04T10:25:02Z
page update

				
				
				
				
				
				← Äldre version
				Versionen från 4 augusti 2017 kl. 10.25
				
Rad 11:
Rad 11:
==Secure cookies only== ==Secure cookies only==



It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.) It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.



==See also== ==See also==

* MDL-55662 for removing the secure cookies only setting



Forum discussions: Forum discussions:



Johnok: Recommend against loginhttps
2017-07-12T07:36:12Z
Recommend against loginhttps

				
				
				
				
				
				← Äldre version
				Versionen från 12 juli 2017 kl. 07.36
				
Rad 4:
Rad 4:
==Use HTTPS for logins== ==Use HTTPS for logins==
HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server. HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.

You are also unable to use the SSL proxy setting at the same time



==Secure cookies only== ==Secure cookies only==



Tsala: rewording
2016-09-07T14:54:12Z
rewording

				
				
				
				
				
				← Äldre version
				Versionen från 7 september 2016 kl. 14.54
				
Rad 7:
Rad 7:
==Secure cookies only== ==Secure cookies only==



In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on i.e. it is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.) It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)  



==See also== ==See also==

← Äldre version		Versionen från 5 juli 2022 kl. 16.06
Rad 11:		Rad 11:
	This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254):		This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254):

	~~<code php>~~		127.0.0.1
	127.0.0.1		192.168.0.0/16
	192.168.0.0/16		10.0.0.0/8
	10.0.0.0/8		172.16.0.0/12
	172.16.0.0/12		0.0.0.0
	0.0.0.0		localhost
	localhost		169.254.169.254
	169.254.169.254		0000::1
	0000::1
	~~</code>~~

	In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.		In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.
Rad 30:		Rad 28:
	This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows:		This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows:

	~~<code php>~~		80
	80		443
	443
	~~</code>~~

	In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.		In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

← Äldre version		Versionen från 13 april 2021 kl. 06.01
Rad 6:		Rad 6:

	It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.		It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

			==cURL blocked hosts list==

			This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254):

			<code php>
			127.0.0.1
			192.168.0.0/16
			10.0.0.0/8
			172.16.0.0/12
			0.0.0.0
			localhost
			169.254.169.254
			0000::1
			</code>

			In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

			'''Note:''' In addition to configuring this at the application level via this setting, it is also recommended that sufficient firewall/network security measures are in place, including restricting access to internal network endpoints to those users/services that require them.

			==cURL allowed ports list==

			This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows:

			<code php>
			80
			443
			</code>

			In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

			'''Note:''' In addition to configuring this at the application level via this setting, it is also recommended that sufficient firewall/network security measures are in place, including restricting access to open ports on the internal network to those users/services that require them.

	==See also==		==See also==

← Äldre version		Versionen från 10 november 2017 kl. 15.52
Rad 1:		Rad 1:
	{{Security}}		{{Security}}
	In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed ~~and instead there~~ is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.		*In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed.
			* There is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.

	==Secure cookies only==		==Secure cookies only==

← Äldre version		Versionen från 9 november 2017 kl. 16.28
Rad 1:		Rad 1:
	{{Security}}		{{Security}}

	In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.		In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.

← Äldre version		Versionen från 9 november 2017 kl. 16.27
Rad 1:		Rad 1:
	{{Security}}		{{Security}}
	~~[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.~~

	~~==HTTPS for logins (deprecated - don't use)==~~		In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.
	~~[https://en~~.~~wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data~~, ~~so it's difficult to sniff out a user's username and password on~~ the ~~network. You will need to enable HTTPS on your server before you turn on this~~ setting~~, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.~~

	~~It is not recommended that you use this setting as it~~'~~s not secure despite using~~ HTTPS for logins~~. Instead, please look at~~ [[~~Transitioning to~~ HTTPS]] ~~completely~~

	~~You are also unable~~ to ~~use the SSL proxy setting at the same time~~

	==Secure cookies only==		==Secure cookies only==
Rad 16:		Rad 10:

	* MDL-55662 for removing the secure cookies only setting		* MDL-55662 for removing the secure cookies only setting

	~~Forum discussions:~~
	*[http://moodle.org/mod/forum/discuss.php?d=79110 Locked out]
	*[https://moodle.org/mod/forum/discuss.php?d=339129 Secure Cookies]

	[[Category:Site administration]]		[[Category:Site administration]]

← Äldre version		Versionen från 6 september 2017 kl. 03.18
Rad 2:		Rad 2:
	[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.

	==~~Use~~ HTTPS for logins==		==HTTPS for logins (deprecated - don't use)==
	[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

	It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.		It is not recommended that you use this setting as it's not secure despite using HTTPS for logins. Instead, please look at [[Transitioning to HTTPS]] completely

	You are also unable to use the SSL proxy setting at the same time		You are also unable to use the SSL proxy setting at the same time

← Äldre version		Versionen från 4 augusti 2017 kl. 14.07
Rad 1:		Rad 1:
	{{Security}}		{{Security}}
	HTTPS for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.

	==Use HTTPS for logins==		==Use HTTPS for logins==
	HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

	It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.		It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.
Rad 11:		Rad 11:
	==Secure cookies only==		==Secure cookies only==

	It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.		It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

	==See also==		==See also==

← Äldre version		Versionen från 4 augusti 2017 kl. 10.25
Rad 11:		Rad 11:
	==Secure cookies only==		==Secure cookies only==

	It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. ~~(It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)~~		It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

	==See also==		==See also==

			* MDL-55662 for removing the secure cookies only setting

	Forum discussions:		Forum discussions:

← Äldre version		Versionen från 12 juli 2017 kl. 07.36
Rad 4:		Rad 4:
	==Use HTTPS for logins==		==Use HTTPS for logins==
	HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

			It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.

			You are also unable to use the SSL proxy setting at the same time

	==Secure cookies only==		==Secure cookies only==

← Äldre version		Versionen från 7 september 2016 kl. 14.54
Rad 7:		Rad 7:
	==Secure cookies only==		==Secure cookies only==

	~~In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on i.e. it~~ is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)		It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)

	==See also==		==See also==

HTTP security - Versionshistorik

Leonstr: Changed to indented

Michaelh2 den 13 april 2021 kl. 06.01

Marycooch: MDL-42834

Tsala: spacing

Tsala: loginhttps setting removed (MDL-42834)

Johnok: Deprecate loginhttps

Germanvaleroelizondo: Added wikipedia link to [https://en.wikipedia.org/wiki/HTTPS HTTPS]

Tsala: page update

Johnok: Recommend against loginhttps

Tsala: rewording

Leonstr: Changed `to indented`