3

This question stemmed from a discussion here: Ad networks that will serve via HTTPS?

My question to the OP was "is it necessary to have every page behind SSL?" Admittedly at the time of posting this question, the OP hadn't got back to me to let me know what kind of site he had, was everything behind a login etc etc

I agree that if everything was behind a login then yes, it should also be protected by an SSL certificate, but if (for example) the site was a wordpress blog, would it be necessary for the parts of the site that were just going to be viewed by your average user (i.e. one that's not logged in) to be accessed over HTTPS. Admittedly, if you were logged in and viewing the "front-end" of the site, it would send over your cookie, but as long as you took precautions against that then it should be ok, right?

Improve this question

1 Answer 1

Reset to default
3

If you took precautions to never visit the non-SSL areas of a site while logged in, and if there was a logout process that properly deleted the authenticating session cookie, then it should be fine. Of course, the more admin-level users you have, the greater the chance that this will never happen.

A more ideal way to do this, for the Wordpress example: move (not copy) /wp-admin to a different domain under HTTPS. That way, you won't have to worry about logging out to make sure your new post got published okay, because cookies are per domain. A cookie for admin.mysite.tld won't be in the request headers for www.mysite.tld, so there's nothing unencrypted to be sniffed and hijacked.

(Granted, if it's a single-author/admin Wordpress site, just tunneling through a VPN when accessing it over a wi-fi hotspot would have the same effect, without the mess of tweaking WP to work across two domains.)

Improve this answer
5
  • Which means you wouldn't get the handy "Edit this post" link on your main site.
    – TRiG
    Commented Dec 14, 2010 at 17:54
  • Personally, I usually remove those anyway, along with any admin login links/forms - the wp-admin area and bookmarks do a fine job. Best way to keep a door closed is to replace it with a brick wall.
    – tadamson
    Commented Dec 14, 2010 at 18:25
  • Wouldn't that solution wreak havoc with users who have their browsers set to reject third-party cookies?
    – Kaji
    Commented Dec 14, 2010 at 21:53
  • @Kaji: For a single user wordpress blog, only ONE user needs to login. Adding an exception for your own site isn't that hard. Also I'm don't think that admin.example.com is considered a third party to example.com
    – Macha
    Commented Dec 14, 2010 at 22:52
  • If the cookie is set specifically for admin.example.com, the browser will send it only when requesting (*.)admin.example.com, but not for anything else under example.com. Kind of a big distinction I should have mentioned: there's no 3rd party, just 2 separate sites.
    – tadamson
    Commented Dec 15, 2010 at 3:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.