I see a lot of websites (including Stackoverflow) using this authentication mechanism:
- Client authenticates under HTTPS and gets back a session id.
- Client drops back to HTTP and accesses secure pages using HTTP, passing the session id to prove that authentication took place.
What's the point of using HTTPS to protect authentication if the man-in-the-middle can simply steal the resulting session id and act as the authenticated client? I understand that session will eventually expire but that still gives the attacker a pretty long window of opportunity to mount an attack.