ASP.NET Login via SSL doesn't persist when switching to non-SSL

Question

I have an application I would like to force SSL on the login page and on the page that the CC is entered on. I would prefer to keep the rest of the application free of SSL.

I have the code working to force SSL on certain pages, and remove SSL on others. The problem I have is that if I log in with SSL enabled the user is only authenticated on the pages that are SSL. The reverse holds true as well, if the user logs in without SSL they are only authenticated on pages without SSL.

What can I do to have this persist between the two. Is this using cookies or the session?

Thanks!

Answer 1

Classically, one would use the session for this.

You can use cookies as well.

In either case, you need to keep in mind that they can be spoofed, so you want to only keep a "logged in" token that you can verify on them.