What are the pros and cons of site wide SSL (https)?
I am working on a site where all authentication is via facebook oauth2. I'd consider the nature of our content to be non-critical (basically news stuff). Had some discussions with client about securing site and felt that there wasn't a great reason to do right now but that Facebook and Microsoft do for all traffic (logged-in and not logged-in) whereas SO doesn't.
Not taking performance into account, would there be any security reason for us to run the site over HTTPS? I am using Rails with OmniAuth. Even though I consider the content to be non-critical, it might be easier to add at this point - perhaps user-to-user messaging (a currently unimplemented feature would require this - perhaps a reason why SO doesn't have user-to-user messaging?). Since all my authentication with Facebook is over HTTPS, would there be ANY reason that my non-HTTPS traffic with the end user would introduce a security risk to the end user?
I am asking because, when it comes to security, I'm often surprised what I don't know.
I'm using HttpOnly cookies in Rails 3.1. One thing I noticed was that I could copy out the cookie and get access even with HttpOnly in a different browser. Hmm.... not what I expected.