Login via SSL

[johnmont]

I would like to have login and usercp functions go through SSL and all other board traffic through regular http://. I've created a symbolic link to the http filesystem directory in my https filesystem directory.

Next, I created a replacement variable for replacing "login.php" to "https://www.mysite.com/login.php". This part works great as I get redirected appropriately to the login page. I then enter my login and password and submit.

I get the redirect intermediate, but when I get redirected back to the http://www.mysite.com, I don't have any privileges as though I'm not logged in. If I go to https://www.mysite.com, all is fine.

Is this due to the cookie? A session variable being different between the two sites?

[johnmont]

It does seem as though it must be a cookie issue --

Does anyone know if the same cookie can be used on http and https? Can I use the secure flag for a cookie even though I'm mainly accessing over http?

[Ntfu2]

i think you'll have to stay under SSL once loged in.

There is no real benefit/disadvantage i can think of that would require SSL login, then back to normal http, i beleive the password is never really passed via plain text anyway

[johnmont]

Thanks for your perspective -- appreciate the input greatly.

As far as SSL, I wanted to make the UserCP area secure (and maybe Private Message) as well since i'm collecting some extra information that could be considered private. I'm also distributing some information I'd rather try and keep secure. On the other hand, I have lots of imagery and high bandwidth downloads that I'd like to avoid SSL for distribution.

Hence my desire to split out the site....

[Ntfu2]

Ah i see now

I'm not a coder by any strectch of the imagination, but you could set the login.php script to set two different cookies by chance, then simply link all instances of private messages and userCP via the ssl connnection?