3 ms·
A more agnostic way of doing this is to serve all your non-security required static content from a subdomain over HTTP, set the secure flag on your cookies, and
by iuguy 16y ago
A more agnostic way of doing this is to serve all your non-security required static content from a subdomain over HTTP, set the secure flag on your cookies, and scope the cookie to the fully qualified domain name (e.g. www.myapp.com rather than myapp.com).
- pilif 16y agoif a page contains mixed content (secured and nonsecured), browsers will complain (and rightfully so). If you want to go the SSL route, then you'll have to serve all assets over SSL too. Also note that SSL doesn't really work with name based virtual hosts (Host:-header), so every site you enable SSL with requires its own IP address. With addresses in general running out quickly, this might be a problem for you (or your host).
- iuguy 16y agoYou are of course, completely correct. Thanks for pointing that out. With larger SSL sites, it's not uncommon to use SSL accelerators and reverse proxy through to the HTTP servers at the back. It's definitely not cheap though.