I am working on a new site, and in order to avoid security hassles, I'm planning to provide Google and Facebook login to my website.

Do I still need a SSL certificate or is it not necessary?

Moreover, when a user goes through Google or Facebook Oauth, do Google and Facebook take care of credentials and passwords?


Using SSL protects your users from being phished

If you don't secure the connection between your website and your client, a man in the middle can change the page content to try stealing users credentials. When the Bob connects to your website his browser fetches the page content. If there is a man in the middle between Bob's PC and your server, he can change the page content before sending them to Bob. In this case, when Bob tries to login your website with Facebook, he will connect to malicious guys website, which tries to fool the user and steal his Facebook credentials.

If you use https in your website, the scenario above will never happen. Because Bob's browser will know the connection is interrupted.

| improve this answer | |
  • Just one more doubt, when one uses Google login, is that connection secure automatically between Google and users authenticating through my website? – Kartik Anand Jun 1 '15 at 9:51
  • When someone use Google login, he/she will be redirected to Google directly to complete authentication process. The connection between user and Google is secure, no need to worry about that. However, if you don't have https on your website an attacker on the visitors side can redirect user to fake google login page to steal his credentials. But if you ask me, I wouldn't worry about this. – Batuhan Jun 1 '15 at 10:36

Good decision to rely on Google/Facebook for user authentication.

I think it really depends on what sort of information will be exchanged between your system and the intended users. Should it be kept private?

As a general rule, it’s best to use SSL when publishing a site that supports user accounts and set the authentication cookie to 'secure' (browser only sends it with https). This makes it much harder to hijack user sessions by a man-in-the-middle - because the cookie will be encrypted.

When you login through Google/Facebook the url you are redirected to is off-course https, but after your users are authenticated it is up to your site to generate a session cookie and maintain user sessions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.