This question already has an answer here:
OK, this question might seem a no-brainer for a professional but keep in mind I am not a professional web developer so my knowledge in this field is very limited.
I have been pondering over time trying to decide if I should make my website accessible with both HTTPS and HTTP (the less important pages not needing encryption) or if I should only use HTTPS for all the pages in my website.
So, what I would say is that my questions basically boil down to:
1) Is this a mistake? Do I really need HTTPS everywhere. It's more computation. And no, I don't live by the - why worry about computation in today's day and age? With the current hardware you should be able to count the number of atoms in a sandwich in less than a day - type of mentality. I think it's a bad mentality for a programmer since it invites sloppy inefficient algorithms to be written. If there's a better way of doing things that allows for lesser computations then I would like to hear it.
2) Is it still somehow possible for a person to inject unwanted code in my webpages when they're in transit to an end user even if I use TLS certificates? I know it sounds impossible but, like I said, I'm not an expert so I would want to hear your opinions.
3) Finally, is HTTPS a good way of preventing cross-site request forgery attacks? I heard somewhere that it is although I couldn't understand the logic behind it. The best it can help with, as far as I see it, is allow the end user to realize that the fake webpage is not secured and help him figure it out that something is fishy. Does it help in any other way other than that? Or do I need to implement some extra fail-safe mechanisms to prevent that?
Thank you for your time!
Also, in response to the duplicate reaction, I still believe that this question is also somewhat original in regards to the fact that I did additionally ask about the computational requirements for a solution as well as asking if XSS can be used even with TLS used