[wp-trac] [WordPress Trac] #28424: XML-RPC endpoint doesn't enforce the admin scheme

[WordPress Trac]

#28424: XML-RPC endpoint doesn't enforce the admin scheme
--------------------------+------------------------------
 Reporter:  johnbillion   |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Security      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  close         |     Focuses:  administration
--------------------------+------------------------------
Changes (by johnbillion):

 * keywords:   => close


Comment:

 A 307 wouldn't solve the issue anyway as it's for temporary redirects ("In
 this case, the request should be repeated with another URI; however,
 future requests should still use the original URI"). If the client did
 respect 307s, requests would still be sent over HTTP and then just re-sent
 over HTTPS. To be effective, we'd need a way to say "stop sending requests
 over HTTP".

 I think you're right that this is something we'll need to live with.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/28424#comment:5>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform