Hmmm.. Good question. Never had that asked before, but the solution should be pretty simple. The cookie that's being set really doesn't need to be secure at all. We don't set any cookies that have session information or anything else of value. That specific cookie simply holds what permissions from Facebook the user has granted. Not much a 'bad guy' could do with that.
However, to get rid of the error, you should be able to edit the /components/com_jfbconnect/includes/jfbconnect.js file. Search for the following line:
document.cookie = escape(sKey) + "=" + escape(sValue) + "; path=/";
Update that to:
document.cookie = escape(sKey) + "=" + escape(sValue) + "; secure; path=/";
That will force the cookie to only be set and read over a secure connection.
We'll have to see if there's a way we can do this automatically in the code. The problem is that most sites run in a mixed-mode of http/https or with no https at all. Also, our code (as mentioned) doesn't really need to secure that cookie.
I hope that gets you going for now though and, should you need anything else, just let us know.
Thanks,
Alex
jfbconnect triggering some modsecurity2 warnings
