For example I have a site example.com. It has its own HTTP JSON API: api.example.com. API has authorisation and it runs under https://.
I need to make visualization of some functionality of JSON API - so I need to make a profile section on example.com:
Authorisation form, and user profile section with actions.
All actions will be done via cURL requests to https://api.example.com.
Do I need to use SSL on example.com too?
Regarding the server to server communication, it's not really necessary to run SSL on example.com, since the communication it makes with api.example.com will be encrypted and the identity of api.example.com will be trusted (using its certificate). If the main site must authenticate itself with the API subdomain, however, it's a good idea to use SSL there too (although other forms of authentication are possible).
From the end-user perspective, however, things are different: since the browser is communicating to the main site using simple http it can expect no protection against MitM attacks, so any data exchanged this way can be read or manipulated by a malicious third-party. This wouldn't be a problem if this data were public and unimportant, but from what I understood the "user profile" involves credentials (authorization - or would it be authentication?) and other actions which I believe should be restricted to that particular user. In that case, use of SSL in example.com is really necessary.
P.S. If the browser is the one accessing api.example.com, then in principle it wouldn't be a problem - since all communication would be done securely - but OTOH you can't trust the code in your page, since it came from an unprotected example.com. In the end, only having the top level site using SSL would ensure proper security (and ideally, no untrusted content should be mixed in).
