SSL Support

[Geoff]

Would it be possible to allow browsing of the site over SSL (HTTPS)? I am aware there's real money and server resource costs in this.

[ZeroHour]

I would like HTTPS but there are quite a lot of issues if you switch from http to https, namely speed and browser access. Server load wouldnt be too bad with our newest network design but those on mobile devices, slow connections, older browsers and https blocked schools would have issues straight off.

IE still blocks non https images/content as well which means the cdn's we use need to move to https as well, its possible to do this but if people insert images etc they will be broken unless people hit the load unsecured content button.

Running both modes has a problem where google can get pretty inflamed by duplicate content as well and you are not really securing anything when you can still get cookie leakage via http calls. Https login would be nice but likewise you dont stop cookie sniffing anyway as soon as you get back to http. We had https login in v3 of vbulletin but when we went to 4 it didnt work well any more and vbulletin had said they were coming up with a solution which has become vapour-ware.

Edited February 11, 2013 by ZeroHour

[Geoff]

I think SSL login + optional (user preference) SSL browsing for logged in users would be the right direction then? That gets round all the issues you cite?