Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to enable HTTPS for my website on pages where data is sent by the user (forms, comments etc).

Does it make sense to enable it only when a page uses forms or is it easier to enable globally?

If not globally, do I also need it on search?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

You should enable it globally, otherwise you'll be vulnerable to the situation where an attacker modifies the unencrypted form to send all the user data to evilserver.com rather than to the one you want (or, since the attacker is actively listening, modify the form action to use HTTP instead of HTTPS).

You may also get into a configuration headache encrypting only on selective paths. It's usually easier just to encrypt everything, and it will prevent the aforementioned attack.

share|improve this answer
    
Thanks, I just thought it would help the performance not to use https when it's not needed. But you're probably right; it might create unwanted problems and unseen cases might not be covered. –  Martin Aug 2 '13 at 13:11
    
SSL isn't the performance hit that it once was. CPUs are faster, more core-capable and there's optimisation mechanisms for SSL if you're really heavy traffic (offload cards, etc). –  Tom O'Connor Aug 2 '13 at 13:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.