Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.

There are many articles on the internet that instruct to secure the admin areas in order to harden the wordpress site, however if the person with credentials is in an active session and browses to another portion of the site that isn't under SSL (say, to check the post they just published), wouldn't that nullify efforts to secure the session? Or am I a crazy lady who doesn't get how this works?

If it would nullify it then how does one secure the admin interface? Is HTTPS an all-or-nothing thing? We already have the contents outside of the install, so that alone helps greatly in hardening the overall site, however we don't want login pages and session cookies out there with their pants around their ankles.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Generally speaking, that's true. Authenticated requests (requests that contain cookies or other state information that identifies a specific user) must only be made via HTTPS for that data to remain reasonably secure.

However, in this particular instance, there may be a potential alternative, which is to set the "secure" attribute on the cookies, and treat the users as unauthenticated on non-HTTPS pages. If they don't need to be authenticated on the non-admin pages, then setting the secure flag on the cookies will insure that they aren't sent along with requests to non-admin pages that aren't protected by SSL.

So, if they cookies need to be sent with every request, then every request needs to be HTTPS. If they don't, then you're equally safe simply making sure that the cookies aren't sent except when the request is protected by SSL.

share|improve this answer
    
There's two conflicting answers here... eeny meenie miny moe? –  kristina childs Mar 29 '13 at 23:22
1  
No, not conflicting, exactly. If you don't set the secure flag on the cookies, the answers are the same. It will be a problem, and you shouldn't have part of the site running under HTTP. I simply gave some additional options. :-) –  Xander Mar 29 '13 at 23:25
    
sweet, that's great thanks so much! –  kristina childs Mar 29 '13 at 23:36
add comment

If you only use HTTPS for the admin section, you'll still end up transmitting your session ID in plaintext when you browse the rest of the site. In order to keep it secure, you need to use HTTPS across the entire site.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.