Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it ok to have http and https requests point to the same directory such as var/www/? It seems like it would be alright since when you're say authenticating a user you can just make sure to call https instead of http. However I can see how a malicious user could use javascript to change the https url to a http url. If it's best to split them between two directories any recommendations on how to do this with a framework since you would have to duplicate a lot of code between the directories?

share|improve this question
up vote 2 down vote accepted

I suppose it would depend on your setup, but most configurations I've seen point them to the same place.

Also, mu:

  1. If JS changed the protocol, a security warning would popup about mixed data confidentiality levels.
  2. If JS can change the protocol you're using, it can also redirect any sensitive information it finds wherever it pleases; it's already game over.
share|improve this answer

If you have data that needs to have its confidentiality or integrity (during transport) protected it would seem to me that not even making it capable of being available via an unencrypted protocol would be prudent. Relying on browser behavior to warn the user that they're receiving content via an unencrypted channel is likely to just be ignored anyway.

How you handle this with your particular framework isn't something I can say w/o knowing more. I wouldn't want any duplication of code but, if I had to, I'd probably symlink the relevant directories.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.