1

I've never encountered this scenario but would the security implications be to such a website?

marked as duplicate by Steffen Ullrich tls Nov 30 '17 at 5:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

Not really. If the user is on a HTTP non-login page, and clicks on a 'login' button, unlikely he/she is going to notice if the login is now using HTTPs or HTTP.

Best to have the entire site on HTTPs.

  • In addition, authentication data for subsequent requests is stored in cookies and are served over plain HTTP. Attacker can sniff them and use to authenticate the user without having to know actual credentials. Something like pass the hash attack. – Crypt32 Nov 30 '17 at 6:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.