SSL for the whole site???

21 Oct 2006, 6:43 PM

#1

New Zenner

Join Date:: Sep 2004
Posts:: 43
Plugin Contributions:: 0

SSL for the whole site???

What if one has the whole thing as https????

I was thinking about that...and maybe an index.html with a quick redirect to the https...
this way the whole website is under a secure connection...
does that makes sense???

I know that https is a bit slower...but wouldn't that be worth it ???

21 Oct 2006, 6:48 PM

#2

Kim

Obaa-san

Join Date:: Jun 2003
Location:: West Coast, North America
Posts:: 26,684
Plugin Contributions:: 0

Re: SSL for the whole site???

Simple answer- no, do not run the whole application under HTTPS.

Please do not PM for support issues: a private solution doesn't benefit the community.

Be careful with unsolicited advice via email or PM - Make sure the person you are talking to is a reliable source.

28 Oct 2006, 6:54 PM

#3

jeffd

Totally Zenned

Join Date:: Sep 2004
Posts:: 605
Plugin Contributions:: 1

Re: SSL for the whole site???

We actually run a site that requires all pages be secure after login since we need to securely collect and process personal information on the site https://www.divorceonyourterms.com for document preparation services. It is really not at all hard to modify Zencart to support this capability. Just thought I'd pass our experience along. If anyone is interested in doing this I'd be glad to share our experiences in this area.

Best of luck!
Jeff

My ZC Contribs:
Ad Manger
External Order Number Generator

28 Oct 2006, 7:05 PM

#4

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,515
Plugin Contributions:: 176

Re: SSL for the whole site???

This is not a report of a hack attempt. Thus, moving this discussion to General Questions

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.