1

I have certain portion of my site to be behind SSL which is reserved for registered users & want rest of the site which is open to public to be served by just http. Currently it is set up so that all the pages be it public or otherwise are served by https. Also botht he public & non-public content resides under the same webroot.

Can you guys suggest me a way to resolve this so or perhaps a best practice guide? Thanks!

EDIT

We use LAMP stack.

3
  • Which server-side technology do you use? Linux, Apache, and PHP?
    – Rob Olmos
    Nov 30, 2010 at 22:29
  • Yes. Sorry I use LAMP stack.
    – Chantz
    Nov 30, 2010 at 22:40
  • Could you please post here relevant parts of your Apache config?
    – Alex
    Feb 9, 2011 at 16:18

6 Answers 6

1

This pseudo-conf for Apache will do what you require: two virtual hosts, one with SSL, and redirects from the SSL-required path(s) to the HTTPS version of the site.

<VirtualHost *:80>
ServerName www.sample.com
DocumentRoot /var/www/www.sample.com

Redirect permanent /secure https://www.sample.com/secure
Redirect permanent /secure2 https://www.sample.com/secure2
</VirtualHost>

<VirtualHost *:443>
Servername www.sample.com
DocumentRoot /var/www/www.sample.com

SSLEngine On
</VirtualHost>

Once you've given your users a cookie keying to their identity, it's best to keep them on the SSL version of the site, so that their cookie can't be hijacked by malicious users on their unencrypted coffeeshop wireless connection, for example. You have a couple of options for making that work. Either use your application language (eg PHP) to detect the cookie and then redirect to the SSL version of the current page, or you could use mod_rewrite to force SSL when the cookie exists. But that's another question...

1
  • Thanks daveadmas for the answer. I had forgotten about asking this question, earlier I just checked in stackoverflow.com for my prev. asked question, did not do the same for here.
    – Chantz
    Feb 9, 2011 at 19:08
2

First, be aware that serving mixed content can trigger browser warnings that tell the user that not everything they are seeing is "secure content".

Second, unless you are experiencing performance or latency problems, it's probably not worth the effort to split up your secure and non-secure content. The marginal server load created by SSL is quite small these days compared to 10-12 years ago, and most of the impact is caused by the initial connection negotiation, which is going to happen no matter what, if any part of your site requires SSL.

That said, if you need the performance boost and you are okay with the potential user confusion/annoyance, then I would recommend setting up a separately named host (eg, if your secure website is www.sample.com, register, eg, static.sample.com as a CNAME/alias to that DNS record (or as a separate IP if you are feeling extravagant)), setting up a new VirtualHost in Apache for that name without SSL enabled, and then use that location to store your static content.

If you need directory-by-directory separation of SSL and non-SSL content, the best way to go is to set up a second VirtualHost in Apache listening to port 80 and pointed to the same place your SSL VirtualHost is pointed, and then add redirects for the URIs that you require to be encrypted. For example:

<VirtualHost *:80>
    ServerName www.sample.com
    DocumentRoot /var/www/www.sample.com

    Redirect permanent /secure https://www.sample.com/secure
</VirtualHost>

<VirtualHost *:443>
    Servername www.sample.com
    DocumentRoot /var/www/www.sample.com

    SSLEngine On
</VirtualHost>

(I obviously left a lot of stuff out, don't try to copy and paste.)

1

The best practice it to not mix http and https traffic. Mixed content can pose a security vulnerability. An attacker could adjust the non-SSL traffic in a way to access the SSL portion.

Javascript in particular is dangerous. But they could change an image which changes the instructions shown on the page. There have also been image and css vulnerabilities in browsers in the past.

Another discussion is here.

If you really want to though, its quite easy. Have two apache vhosts, one SSL and one not; but otherwise the same. Then in your php code, reference your URLs appropriately.

I this for a lot of my sites. For instance, the site is non-SSL until your login, then its entirely SSL from there.

1
  • Right. I think it would be best to not go for splitting up https & http responses because of the inherent complexities in doing that. The site is supposed to be small in scope which further adds to leaning towards providing response through only https.
    – Chantz
    Feb 9, 2011 at 19:11
0

Best practice is to force the protected pages to be only accessed via HTTPS and non-HTTP pages to not be accessed via HTTPS. Using a language like PHP you can detect this and redirect the user to the appropriate protocol. You can also set this up via mod_rewrite if need be.

One issue you may notice is that if you serve a page via HTTP and a MITM attack is at play, the attacker can manipulate the HTML and change forms and links to instead go to HTTP so the attacker can still monitor. So even if you force a page to be accessed only via HTTPS the attacker still snooped any sensitive data.

A currently proposed solution to this is HTTP Strict Transport Security which is already in use on some websites. This brings the forcing of HTTPS into the browser so even if a form action was mangled via a MITM the browser won't submit it over HTTP.

5
  • 1
    Also keep in mind that on some browsers (certain versions of IE come to mind), you will receive browser warnings when mixing secure and non-secure sources, such as HTML over HTTPS and images over HTTP.
    – Andrew M.
    Dec 1, 2010 at 3:51
  • @Redmumba That's a good point thanks. FF will give an exclamation mark on the lock and not show the SSL button in the URL bar.
    – Rob Olmos
    Dec 1, 2010 at 3:54
  • Yeah, I only point IE out specifically because it pops up a dialog box that is EXTREMELY annoying and cannot be hidden (i.e., "Do not show this again"). :)
    – Andrew M.
    Dec 1, 2010 at 3:56
  • 1
    "Using a language like PHP you can detect this" - while I agree with most of Rob's answer, there are lots of scenarios where you can't explicitly detect use of SSL - but its always possible to implicitly detect use of SSL (e.g. if the SSL is terminated on a seperate machine, then run the 'secure' vhost listening on a different port from 80)
    – symcbean
    Dec 1, 2010 at 10:44
  • @symcbean One example I know of is AWS ELB but with any SSL terminating points it should inject a header like (using PHP) $_SERVER["HTTP_X_FORWARDED_PROTO"] set to "https"
    – Rob Olmos
    Dec 1, 2010 at 18:26
0

If you mix https and http content, client get error "Unauthenticated content warning".

0

Apache actually makes it hard to mix up content like this - the SSL and non-SSL sites must be defined under seperate vhosts - you just need to make sure the directory trees don't overlap.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .