Re: ssl in portions of my site

From: karl [x y] (jamescagney90210@excite.com)
Date: 07/30/02 

From: "karl [x y]" <jamescagney90210@excite.com>
Date: Tue, 30 Jul 2002 13:57:54 -0400

"jpreza" <jpreza1@hotmail.com> wrote in message
news:38c101c237de$f525ae70$3aef2ecf@TKMSFTNGXA09...
> Can I apply SSL on only a portion of a website? Instead
> of the entire site???

Be careful... if you accidentally remove anonymous logon and add basic
authentication or windows authentication to a file or folder, but forget to
use or require SSL for that folder, you could end up sending unencrypted
passwords across the internet in plain text over a regular http://
connection. For example, if you have an unencrypted http:// folder with an
.HTM or .ASP page that calls images from the \images\ folder somewhere else
on the web site, and the \images\ folder does not allow anonymous browsing,
then the password could be sent in plain text.

Also, some of your users may have their IE settings to give them a popup box
whenever the mode changes from HTTPS to HTTP and vice versa or if a page
contains some HTTP and some HTTPS elements. This popup box can get
annoying, although you could argue that it's their responsibility to get rid
of this, since this is a setting that you can't control. On the other hand,
using HTTPS only where it is needed can theoretically speed up the web
browsing experience and reduce the CPU load on the web server.

Relevant Pages

  • Re: SSL
    ... folder that are part of your web site. ... want HTTPS to work by right clicking on the file or folder and going to ... There you can set up SSL on the ...
    (microsoft.public.win2000.security)
  • RE: ISA 2006 and SSL
    ... same user can access the site in question by creating an SSL-Tunnel and is ... Microsoft Online Partner Support ... | Subject: RE: ISA 2006 and SSL ... | | rule to allow HTTPS to local host, instead of all http and https ...
    (microsoft.public.isa)
  • Re: RWW with no https
    ... I do not consider a:8080 a url that is appropriate for a SSL end user connection. ... So just so we are all clear, RWW HAS to go over HTTPS. ... Even if I do https but port 8080 would not matter ...
    (microsoft.public.windows.server.sbs)
  • Re: Cannot Access Includes Above Current Directory if using SSL
    ... I'm new to your list and configuring Apache with the SSL module enabled ... similar nested levels in directory tree but not SSL). ... within the https directory tree. ... The SSI is mostly for testing trying to figure out why my PHP scripts ...
    (php.general)
  • Cannot Access Includes Above Current Directory if using SSL
    ... I'm new to your list and configuring Apache with the SSL module enabled ... similar nested levels in directory tree but not SSL). ... within the https directory tree. ... The SSI is mostly for testing trying to figure out why my PHP scripts ...
    (php.general)