CODEWITHSUNDEEP
httphttpswebserverlocalhostbrowser-cache
Nishant Jani
Nishant Jani

Reputation: 1993

Http AND https on my website

i have an ambitious plan as such : i want pages such as Registration , login , transactions to be directed to HTTPS server whereas other operations such browsing through my website like "contact us or feedback or terms and policy" i don't want to bother with the HTTPS server i just want it to be HTTP

How can i achieve this ?

My main aim for this "selective protocol" is to speedup my site loading time

One extraneous small question too : Does a browser "cache" pages from localhost ? at least chrome doesn't , would a browser cache webpages from the localhost (XAMPP) ?

Upvotes: 0

Views: 451

Answers (1)

manzoid
manzoid

Reputation: 1225

This is common practice. Simply use absolute URL's for the links to secure pages such as registration and login, so you can specify the https protocol. Other links can remain relative.

One gotcha is that if you use relative links on a page you served with https, they will remain in https. E.g., if you have a common top-navigation bar that's rendered on all pages... then on normal (http) pages, like your homepage, relative links in that bar will also be http. However on an https page such as registration, if the user clicks away using that top-nav bar, relative links will be https, "inheriting" the protocol of the surrounding page. Just something to be aware of. It's not ideal to invoke https if you don't need it, as it's more computationally expensive to process such requests.

Update

Further discussion with @user1537158 clarified that https was being produced for all pages, which was not the desired behavior. Furthermore the server environment was PHP served by Apache.

The PHP code is probably not causing that to happen, some Apache configuration is more likely the culprit. There is likely a "rewrite rule" that's causing this behavior. A "rewrite rule" is a directive to Apache telling it to modify the incoming request in some manner, for example, redirecting it, or rejecting it.

Here is a quick overview of what I am referring to: http://wiki.apache.org/httpd/RewriteHTTPToHTTPS

So, next steps in this particular case:

  1. Get your sysadmin to double-check the configuration. It might be in httpd.conf, or other config files that are referenced by Apache, and there is a way to do this in .htaccess files too, which can reside in the individual directories being served.
    • investigate why all URL's are getting rewritten to https
    • set up rewrite rules to force certain URL's to be https
  2. Make sure that the links and actions inside the code (PHP, templates, javascript, etc) properly reference the absolute URL, including the https protocol, when navigating to the secure pages.

Upvotes: 1

Related Questions