CODEWITHSUNDEEP
asp.netweb-serviceshttphttpsasp.net-web-api2
Samantha J T Star
Samantha J T Star

Reputation: 32828

If my web site is HTTPS does every call for data or a static page have to be HTTPS also?

I have a web api application that I am considering moving to HTTPS. The reason is really just for the initial login where I would like to hide the username and password.

Once logged in do all other calls from the pages also need to be HTTPS? For example do my calls to CSS and scripts need to travel over HTTPS? How about WebAPI calls?

Upvotes: 2

Views: 362

Answers (1)

vtortola
vtortola

Reputation: 35945

When referencing HTTP content from HTTPS pages, some user agents will issue warnings about "mixed content" or "insecure content" to the user, others may block the content (older versions of IE do that). GitHub solved this issue using ngnix as reverse proxy, so it serves the static content as HTTPS.

If you are only worried about the authentication, and it is cookie based, you can do the authentication in HTTPS and then get back to HTTP. The cookie will be shared as long it is not marked as Secure. Remember that both the GET request acquiring the login FORM and the POST call sending the login form should be HTTPS to be secure.

You can use the page in HTTP and do the AJAX calls in HTTPS: Ajax using https on an http page. Again, this may be useless if the auth form is not secure as well.

If your static content is hosted in a CDN, probably the CDN is able of proxying the requests to your site and return HTTPS content if required.

Static content served as HTTP won't be cached for when you request the same content through HTTPS, neither viceversa, so it will basically downloaded twice.

Also relevant, please check these 7 myths about HTTPS, specially myth #1. If you are worried about security, maybe switch completely to HTTPS is the best decision.

Upvotes: 7

Related Questions