100% HTTPS 网站的优点和缺点是什么？
首先，我承认我对 HTTPS 的了解还很初级。我不太了解会话安全性、加密或这些事情应该如何完成。
我所知道的是网络安全很重要； XSS、CSRF 和数据库注入的恐怖故事一遍又一遍地出现。我知道针对此类漏洞采取预防性态度比被动应对要好。
但这个问题的动机来自不同的角度。我在一个定期接受用户付款的网站工作。显然，付款是通过安全通道 (HTTPS) 发送的。我主要负责网站的 CSS、HTML 和 JavaScript。据我所知，必须先复制 CSS、JavaScript 和图像文件，然后才能通过 HTTPS 调用它们。所以假设我有以下文件：
- css/global.css
- js/global.js
- images/
- 徽标.png
- bg.png
按照我的理解，这些文件需要复制才能“添加”到 HTTPS。因此，文件可以处于安全状态 (HTTPS)，也可以不处于安全状态。
如果这是真的，那么这就是一个重大障碍。即使在最小的站点中，复制文件并且每次更改 CSS 或 JS 时都必须维护它们也是一件很痛苦的事情。显然，可以通过将所有内容移至 HTTPS 来缓解这一问题。
所以我想知道的是，完全支持 HTTPS 的网站有哪些优点和缺点？它会导致明显的开销吗？对整个网站进行加密是不是很愚蠢？用户在整个访问过程中看到浏览器中的“安全”通知是否会感到更安全？最后但并非最不重要的一点是，它真的打造更安全的网站？ HTTPS 不能防御什么？
First, let me admit that what I know about HTTPS is pretty rudimentary. I don't know much about session security, encryption, or how either of those things is supposed to be done.
What I do know is that web security is important; that horror stories of XSS, CSRF, and database injections pop up over and over again. I know that a preventative stance against such exploits is better than a reactive one.
But the motivation for this question comes from a different point of view. I work at a site that regularly accepts payment from users. Obviously, the payments are sent over a secure channel (HTTPS). I mainly work on the CSS, HTML, and JavaScript of the site. What I've been told is that it is necessary to duplicate CSS, JavaScript, and image files before they can be called over HTTPS. So assume I have the following files:
- css/global.css
- js/global.js
- images/
- logo.png
- bg.png
The way I understand it, these files need to be duplicated before they can be "added" to the HTTPS. So a file can either be under security (HTTPS) or not.
If this is true, then this is a major hindrance. In even the smallest site, it would be a major pain to duplicate files and then have to maintain them every time you make a CSS or JS change. Obviously this could be alleviated by moving everything into the HTTPS.
So what I want to know is, what are the pros and cons of a site that is completely behind HTTPS? Does it cause noticeable overhead? Is it just foolish to place the entire site under encryption? Would users feel safer seeing the "secure" notifications in their browser during their entire visit? And last but not least, does it truly make for a more secure site? What can HTTPS not protect against?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
您可以通过 HTTPS 提供与通过 HTTP 相同的内容（只需将其指向相同的文档根）。
缺点可能是主要的，也可能是次要的，具体取决于：
这些都是非常基本的，但只是一些需要注意的事项。另外，就我个人而言，如果看到整个网站都是 HTTPS，如果它与金融相关，我感觉好多了，显然，但就一般浏览而言，不，我不在乎。
You can serve the same content via HTTPS as you do via HTTP (just point it to the same document root).
Cons that may be major or minor, depending:
Those are pretty basic, but just a few things to note. Also, personally, I feel much better seeing that the entire site is HTTPS if it's anything related to financial stuff, obviously, but as far as general browsing, no, I don't care.
明显的开销？是的，但是现在随着客户端和服务器速度越来越快，这一点越来越不重要。
您不需要复制所有内容，但确实需要使这些文件可通过 HTTPS 访问。您的 HTTPS 和 HTTP 服务可以使用相同的文档根。
对整个网站进行加密是不是很愚蠢？通常不会。
用户会感到更安全吗？大概。
它真的能让网站变得更安全吗？仅在处理客户端和服务器之间的通信通道时。其他一切仍然有待争夺。
Noticeable overhead? Yes, but that matters less and less these days as clients and servers are much faster.
You don't need to make a copy of everything, but you do need to make those files accessible via HTTPS. Your HTTPS and HTTP services can use the same doc root.
Is it foolish to put the whole site under encryption? Typically no.
Would users feel safer? Probably.
Does it truly make for a more secure site? Only when dealing with the communication channel between the client and the server. Everything else is still up for grabs.
你被误导了。假设您已将 http 和 https 映射设置为指向服务器上的同一物理网站，则无需复制 css、js 和图像文件。唯一重要的是，当您正在查看的页面也在 https 下时，这些文件将通过 https 引用。这将防止出现可怕的安全消息，表明页面上的某些对象不安全。
对于在 http（不安全）下运行站点的每个其他页面，您可以在相同位置引用这些相同的文件，但使用 http 地址。
为了回答你的另一个问题，将整个网站置于 https 下确实会降低性能。服务器必须努力加密通过网络发送的所有内容。然后一些不太旧的浏览器默认不会将https内容缓存到磁盘，这当然会导致服务器的负载更重。
因为我希望我的网站尽可能具有响应能力，所以我总是有选择性地选择对网站的哪些部分进行 SSL 加密。在大多数典型的电子商务网站中，唯一需要 SSL 加密的页面是登录、注册和结帐页面。
You've been misinformed. The css, js, and image files need not be duplicated assuming you've set up the http and https mapping to point to the same physical website on the server. The only important thing is that these files are referenced with https when the page you're looking at is also under https. This will prevent the dreaded security message that says that some objects on the page are not secured.
For every other page where you're running the site under http (unsecured) you can reference those same files in the same locations, but with an http address.
To answer your other question, there would indeed be a performance penalty to put the entire site under https. The server has to work hard to encrypt everything it sends over the wire. And then some not-so-old browsers won't cache https content to disk by default, which of course will result in an even heavier load on the server.
Because I like my sites to be as responsive as possible, I'm always selective about which sections of a site I choose to be SSL-encrypted. In most typical e-commerce sites, the only pages that need SSL encryption are the login, registration, and checkout pages.
整个站点不支持 SSL 的传统原因是处理时间。使用 SSL 确实需要客户端和服务器都做更多的工作。然而，与现代处理器相比，这种开销相当小。
如果您正在运行一个非常大的站点，并且要加密所有内容，则可能需要稍微加快扩展速度。
您还需要购买证书，或使用用户可能不信任的自签名证书。
您还需要一个专用的 IP 地址。如果您使用共享主机系统，则需要有一个可专用于在您的站点上仅使用 SSL 的 IP。
但是，如果您能负担得起证书和私有 IP 并且不介意需要速度稍快的服务器，那么在整个站点上使用 SSL 是一个好主意。
考虑到 SSL 可以缓解的攻击数量，我会说这样做。
The traditional reason for not having the entire site behind SSL is processing time. It does take more work for both the client and the server to use SSL. However, this overhead is fairly small compared to modern processors.
If you are running a very large site, you may need to scale slightly faster if you are encrypting everything.
You also need to buy a certificate, or use a self signed one which may not be trusted by your users.
You also need a dedicated IP address. If you are on a shared hosting system, you need to have an IP that you can dedicate to only having SSL on your site.
But if you can afford a certificate and private ip and don't mind needed a slightly faster server, using SSL on your entire site is a great idea.
With the number of attacks that SSL mitigates, I would say do it.
您不需要这些文件的多个副本即可使它们与 HTTP 配合使用。如果托管设置已配置为具有单独的 https 目录，则您可能需要拥有这些文件的 2 个副本。因此，回答您的问题 - HTTP 不需要重复文件，但取决于网络托管配置 - 可能需要。
关于 https 与 http 的优缺点，已经有一些帖子讨论了这个问题。
HTTP 与 HTTPS 性能
HTTPS 与 HTTP 速度比较
HTTPs 仅加密客户端计算机和服务器之间的数据。它不包含软件漏洞或远程 JavaScript 等问题。 HTTPs 不会让您的应用程序变得更好 - 它只会帮助保护用户和您的应用程序之间的数据。您需要确保您的应用程序没有安全漏洞，练习过滤所有数据、SQL，并经常查看安全日志。
但是，如果您只负责网站的前端部分，我不会担心它，但会向后端的主要开发人员提出安全问题。
You do not need multiple copies of these files for them to work with HTTPs. You may need to have 2 copies of these files if the hosting setup has been configured in such that you have a separate https directory. So to answer your question - no duplicate files are not required for HTTPs but depending on the web hosting configuration - they may be.
In regards to the pros and cons of https vs http there are already a few posts addressing that.
HTTP vs HTTPS performance
HTTPS vs HTTP speed comparison
HTTPs only encrypts the data between the client computer and the server. It does not software holes or issues such as remote javascript includes. HTTPs doesn't make your application better - it only helps secure the data between the user and your app. You need to make sure your app has no security holes, practice filtering all data, SQL, and review security logs frequently.
However if you're only responsible for the frontend part of the site I wouldn't worry about it but would bring up concerns of security with the main developer for the backend.
问题之一是 https 流量可能会被阻止，例如在 Apple 计算机上，如果您设置家长控制，则会阻止 https 流量，因为它无法读取加密内容，您可以在此处阅读：
http://support.apple.com/kb/ht2900
One of the concerns is that https traffic could be blocked, for example on Apple computers if you set parental control on it blocks https traffic because it can't read the encrypted content, you can read here:
http://support.apple.com/kb/ht2900
在您的网站上使用更多 https 的一个重要“优点”如下：
通过未加密的 WiFi 连接的用户（例如在机场）可以在 https 中提供密码，但如果网站在输入密码后切换回 http页面上，会话 cookie 就会暴露并可以立即被窃听者使用。
请参阅这篇文章 http://steve .grc.com/2010/10/28/why-firesheeps-time-has-come/#comment-2666
An important "pro" for more https at your site is the following:
a user connecting thru an unencrypted WiFi, like at an airport, can give their password in https, but if the site then switches back to http after the password page, the session cookie becomes exposed and can be immediately used by an eavesdropper.
See this article http://steve.grc.com/2010/10/28/why-firesheeps-time-has-come/#comment-2666