Consider a page,
http://example.com, which can be viewed both publicly and when a user authenticates. Now suppose you enable HTTPS for every page when a user logs into your website, but only when they are logged in. Your page,
http://example.com now becomes
https://example.com for all logged in users. If that logged in user likes your page and decides to link to it through a blog post or a social media website, there is a good chance that they will use the HTTPS version of the URL.
From an SEO perspective, what's your strategy for avoiding duplicate content issues between the two URLs?
What should happen if a user arrives at the HTTPS URL but has not logged in or does not have an account? Should there be a redirect to the HTTP version? If so, how would you handle it?
My instinct is that for all pages that can be viewed both publicly and while logged in, the page should first detect if the user is logged in. If logged in, it remains HTTPS or uses a 302 redirect from the HTTP version to HTTPS. If the user is not logged in and they arrive to the HTTPS version of the URL, it uses a 301 redirect to the HTTP version. However, I would welcome a more elegant or effective solution.
Edit: I was assuming that if a user is logged in, every URL should be HTTPS (or at least, that should be an option), but as I've done a little more research, perhaps that assumption was wrong. The way that I see people implementing it is that they only enable HTTPS for pages that send and receive sensitive data: login, shopping cart checkout, user profile management, etc. I'm trying to figure out which model is best.
Apparently, Google Mail gives users the option of whether or not to use HTTPS on every page through a setting in the user's profile. That's certainly an option, but I would still need to address the behavior of publicly available pages for all authentication states.
Because I'm building a content management system that will be used by other people, I need to make sure I get it right. What settings should be available to the site owner? At this point, I'm thinking granular control over each page (whether or not it's secured with SSL) and then for the whole site as well. However, giving that level of control might be a mistake if people don't understand all of the issues and could end up causing security issues. That, perhaps, is the first issue. What are appropriate levels of control and what are intelligent defaults? The second is how the pages should behave for the user. From an SEO perspective, I think that either the process I described above or using the
rel="canonical" (like jmb suggested) would work, but nailing down the behavior of the page so that it is secure and seamless is essential as well.