All geek questions in one place

Is it wrong to configure the web server to map HTTP and HTTPS traffic to the same document root?

Is there something wrong with setting up a web server to map SSL traffic (port 443) to the same document root as normal traffic (port 80)?

Using the same document root for http and https means that you need to implement the following:

  • Each page that needs to be protected must have some application code that redirects the user to the https version if they somehow get into the http version (or redirect the user to the login page if they don’t have a session).
  • The login page should always be redirected to the https version.
  • For pages accessible via HTTP and HTTPS, you need to set a canonical URL to make sure it does not appear as you have duplicate content.

Is there a better way to set up encryption for user account pages? Is there a better way to separate a website from HTTP and HTTPS?

+3
source share
3 answers

It is not necessary to do it wrong, but, as your points 1..3 show, it introduces complications. It seems to me that creating a separate document root can be much easier than working with complications.

+1
source

Internet Information Server 7.X " ", HTTPS, .

, .

+1

http https "--" . -- HTTP-, HTTPS, HTTPS-.

+1

Source: https://habr.com/ru/post/1727217/

More articles:


All Articles