views:

23

answers:

1

As part of a master page template, several sites include a login control. Since the site is served over HTTP, I want the login control, once a successful login has been achieved, to resolve to a portal served over HTTPS.

The closest I've seen to achieve this may be here, but I'm not entirely clear on its implementation.

Can I get some feedback or suggestions on this?

Of course, a simple "Login" link on all pages that point to a login paged served over HTTPS is another solution, but this is not what I'm looking for.

Thanks.

+1  A: 

This is way outside my area of expertise, but don't you want login to occur over a secure connection to begin with, rather than going to the secure server after login?

Bill Horvath II
+1 When a site only uses SSL partially related to the login, it is typically that the login goes over SSL, then redirects back to the non-SSL portion of the site (since the session token cookie is itself encrypted already)
Andrew Barber
Yeah, that does make sense. I was thinking of posting to the HTTPS validation code from HTTP, but that pretty much answers my question. I don't want send sensitive data over HTTP through to HTTPS, so a separate login page served over HTTPS is the way to go.
ElHaix