CouchDB cookie authentication with HTTPS
I finally figured out what I should do in this case. I need to combine basic authentication and cookie authentication to be able to log in.
curl -kX POST -u admin:admin https://localhost:6161/_session \ -H 'Content-Type:application/x-www-form-urlencoded' \ -d 'name=admin&password=admin'Maybe it is because I set require_valid_user = true, and cookie authentication is one of the REST API, while basic authentication is part of the HTTP protocol, and the flag above affects in the HTTP level.
But now there is still the problem: do I need to provide twice the login information each time to do cookie authentication? How about I provide one login for basic authentication and another login for cookie authentication? Could this be a threat for the system?