Now generates secret containing all printable ASCII chars, making it way
more random than with hex encoded random string.
Signed-off-by: Michal Čihař <michal@cihar.com>
Now URL::getCommon always returns HTML encoded string, if you want
unencded one, use URL::getCommonRaw. This makes it easier to review the
code if uses correct variant.
Also I've fixed several wrong uses of the HTML encoded variant in
Location header.
Signed-off-by: Michal Čihař <michal@cihar.com>
In most setups we simply do not have enough information to decide
whether user has come through HTTPS or not leading to infinite
redirects.
Anyway this is better to handle at web server side together with setting
HSTS headers.
Issue #11412, #11883
Signed-off-by: Michal Čihař <michal@cihar.com>
