3 ms·
I've seen some sites which figure out a way to force the user in and out of SSL for certain URLs. You might be able to implement a fix which forces SSL for the
by euroclydon 16y ago
I've seen some sites which figure out a way to force the user in and out of SSL for certain URLs. You might be able to implement a fix which forces SSL for the admin section and non-SSL for everything else.
- patio11 16y agoThat doesn't help, because my all-powerful admin session is as secure as the least secure page I access (or can be made to access) while on a compromised network.
- euroclydon 16y agoDoh. Of course. It's all on the same domain. Do you think, that if designing a new application, it would make sense to make a separate admin sub-domain (assuming no wildcard cookies)? Does the solution entail purchasing legit ssl certs for your static content domains?
- alanh 16y agoEr, can’t you just specify that the session cookie is only sent over HTTPS?