http and restricted section

Question

Hi, I would like to ask you guys cause I am not sure about the answer.

I have website, Asp.Net 2.0, where I have section where only authenticated user has access. For sure user is redirected to restricted section only after successful authentication (login/pass). But my question is more concerned about fact if I need to use https over http. I do check on Page_load method that user is authenticated and is in appropriate role. Like this:

  protected void Page_Load(object sender, EventArgs e)
  {
     if (!IsPostBack)
     {
        ApplyAuthorizationRules();
        InitData();
     }
  }

  private void ApplyAuthorizationRules()
  {
     //Check if the user is logged in
     if (!Page.User.Identity.IsAuthenticated)
     {
        Response.Redirect(NotAuthenticated.UrlToSelf());
     }
     //check if the user is in one of FU roles
     if (!Page.User.IsInRole(Constants.ROLECLIENT))
     {
        Response.Redirect(NotAuthorized.UrlToSelf());
     }
  }

Just for better desc, there is snapshot of my web.config setting:

  <identity impersonate="false" />
  <authentication mode="Windows" />
  <authorization>
    <allow users="*" />
  </authorization>

and there is snapshot of my auth process:

  public static bool Login(string username, string password)
  {
     AppIdentity identity = AppIdentity.GetIdentity(username, password);
     AppPrincipal principal = new AppPrincipal(identity);
     HttpContext.Current.User = principal;

     return identity.IsAuthenticated;
  }

So is it really neccessary to use https?

Thanks for any suggestion. X.

Answer 1

Authorization and encryption serve different purposes. If the data is sensitive you should probably use https.

Answer 2

Assuming you used "Basic" HTTP authentication, then be aware that if you use http, the username,password is send in the clear with every request. If you want to provide more security to prevent the credentials from being sniffed then use https.

There are other methods, such as Digest authentication which offer a little more protection, but generally speaking, use https for anything which a user might feel protective of.