3

I want to enable HTTPS for my website on pages where data is sent by the user (forms, comments etc).

Does it make sense to enable it only when a page uses forms or is it easier to enable globally?

If not globally, do I also need it on search?

Improve this question

1 Answer 1

Reset to default
7

You should enable it globally, otherwise you'll be vulnerable to the situation where an attacker modifies the unencrypted form to send all the user data to evilserver.com rather than to the one you want (or, since the attacker is actively listening, modify the form action to use HTTP instead of HTTPS).

You may also get into a configuration headache encrypting only on selective paths. It's usually easier just to encrypt everything, and it will prevent the aforementioned attack.

Improve this answer
2
  • Thanks, I just thought it would help the performance not to use https when it's not needed. But you're probably right; it might create unwanted problems and unseen cases might not be covered.
    – Martin
    Aug 2, 2013 at 13:11
  • SSL isn't the performance hit that it once was. CPUs are faster, more core-capable and there's optimisation mechanisms for SSL if you're really heavy traffic (offload cards, etc).
    – Tom O'Connor
    Aug 2, 2013 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .