I am doing a token based authentication but facing some security problems. In the system, a user will login as follows:
- Type username and password to login in a https login page
- If the login is succeeded, the server will be set a 'authentication cookie'. Otherwise, go to login page again
- The 'authentication cookie' in every request will be used to identify the user.
I think this is secure if the request is under https because the 'authentication cookie' cannot be stolen easily due to encryption of SSL. I don't want all pages in my website can be accessed under https only. However, if the page can be accessed under http, then connection may subject to 'man-in-the-middle' attack. If the data in cookies is copied, then it is game over.
What is good practice of cookie-token based authentication under http ? Could you give me the detailed implementation about the good practice?