3 ms·

You're think about right solution, but you're overdoing it and in the end you're unnecessary complicating very simple thing. The simplest (and IMHO the best) s

You're think about right solution, but you're overdoing it and in the end you're unnecessary complicating very simple thing. The simplest (and IMHO the best) solution is to have everything served over HTTP for unauthenticated users and everything served over HTTPS for authenticated users (this requires authentication cookie marked as "secure" and regular cookie "authenticated=true" that would redirect authenticated user to HTTPS version of the site in case that he/she would go to the HTTP site).

al_james 16y ago
But then we can't server ads to signed in users which would be a large revenue cut for us.
- piotrSikora 16y ago
  Of course you can... unless you want to serve ads over HTTP, then indeed, you can't really do that.
  - al_james 16y ago
    All the advertising networks we deal with only offer HTTPS. Hardly any advertising networks support HTTPS.
    - piotrSikora 16y ago
      ...and if noone will complain about that then it won't change.