https during login page, then change to http

Just a quick question, and my 5p worth (With the state of the pound it's gone up from the usual 2p)... If the security of the site is such that you need to authenticate with SSL, why is non-SSL traffic OK afterwards?

 

 

HTTP is just too easy to hijak... No matter what you do, any access after you switch to HTTP can only be considered to be suspect... And if you share the authentication cookie (Assuming you're using cookies) between SSL and non-SSL your SSL is now suspect too.

 

 

(In fact I can think of exactly ONE instance where it would be useful. To customise the look of a page by user... But only if SSL & non-SSL authentication information isn't shared, the data is non-sensitive and the HTTP portion is read-only).

 

 

H