3 ms·
There are too many security holes and corner cases to serve any authenticated page over http. It's better to have your login page be served over https, but if y
by herge 11y ago
There are too many security holes and corner cases to serve any authenticated page over http. It's better to have your login page be served over https, but if you use authentication cookies, any MITM can easily pick them up from the following http pages and do what they want (for as long as the cookie is valid).
And that's beside a whole rake of issues from having http and https on the same domain. It's just easier to have https everywhere.
- chimeracoder 11y ago> It's just easier to have https everywhere. For what it's worth, this was not true ten (or maybe even five) years ago. I'd say it's true today, for most websites, but it's worth keeping in mind that it's a relatively recent phenomenon that HTTPS is now pretty easy to set up, use, and maintain. That wasn't always the case!
- herge 11y agoFive years ago was 2010. Other than Let's Encrypt, AFAIK, there hasn't been exactly leaps and bounds in terms of making https easier, at least for self-managed servers. It's still buy a certificate and set it up in nginx/apache/your favourite load balancer/etc.
- geostyx 11y agoI have found Caddy (https://caddyserver.com https://caddyserver.com) really helpful in this regard. By default it grabs a Let's Encrypt cert and serves your site over HTTPS (oh and it handles renewals too.) Caddy + LetsEncrypt = easy https everywhere :D
- chimeracoder 11y ago> It's still buy a certificate and set it up in nginx/apache/your favourite load balancer/etc. To a first order approximation, yes, and for small and medium sites, that's pretty accurate. But for very large sites, there can be additional complications and expenses, and that situation has improved over the last several years. Don't underestimate the effect that the downward price of bandwidth over the years has had - at very large scale, those pennies can really add up. There's a reason why sites like Google, Facebook, Reddit, Tumblr, etc. took so long to add SSL to everything Or why some sites like Comcast still don't provide it. It's not (always) that they simply don't care or don't have knowledgeable engineers; it's that the logistics of managing[0] SSL at that scale are non-trivial. Arguably worth it, yes, but it's not so straightforward. [0] heck, the logistics of paying for - even with a CDN, the marginal cost of adding SSL is not cheap.
- primary_key 11y agoSNI and IPv6 are two pretty big ones since the limited number of IPv4 addresses limited the practicality of having one IP for each SSL site.