通过 HTTPS 发送 cookie，但通过 HTTP 发送 HTML
HTTPS 的成本很高，因此我只想通过 HTTPS 发送会话 cookie，并通过 HTTP（不安全）发送网站 HTML。
1) 登录期间，cookie和登录数据通过HTTPS发送给用户。
2) 在页面请求期间，cookie 通过 HTTPS 发送到服务器，但响应（响应中没有 cookie！）通过不安全的 HTTP 发送。
是否可以通过 HTTPS 向服务器发送 cookie，但通过 HTTP 接收 HTML？
这样做的原因是为了消除会话劫持的变化。发送的 HTML 无需受到保护。
HTTPS is costly, so I want to send only the session cookies through HTTPS and the website HTML through HTTP (unsecured).
1) During login, cookies and login data are sent to user through HTTPS.
2) During page requests, the cookie is sent to server via HTTPS, but response (no cookies in response!) is sent over unsecured HTTP.
Is it possible to send cookies to server over HTTPS, but receive HTML over HTTP?
Reason for this is to eliminate changes of session hijacking. Sent HTML is not necessary to be secured.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
否。响应与请求在同一通道中执行，因此两者都必须是 HTTP 或 HTTPS。
No. The response is performed in the same channel as the request, therefore both must be either HTTP or HTTPS.
Cookie 随每个请求一起发送到服务器。解决这个问题的唯一方法是使用 HTTPS 从一个域发送 cookie，并使用 HTTP 从另一个域（或子域）发送其他所有内容。这意味着您在使用 HTTP 时无法利用会话或 cookie。
最实用的方法是通过 HTTPS 请求一个非常小的页面，其中有一些 javascript 通过 HTTPS 请求所有用户特定数据，并通过普通的旧 HTTP 请求所有静态信息（图像、html、css 等）。
Cookies are sent with EVERY request to the server. The only way around it is to send the cookies from one domain using HTTPS and to send everything else from another domain (or subdomain) using HTTP. This means you cannot take advantage of sessions or cookies when using HTTP.
The most practical way to do this is to request a very small page through HTTPS which has some javascript to request all the user specific data through HTTPS and request all the static information (images, html, css, etc) through plain old HTTP.
请记住，混合 HTTP 和 HTTPS 并不安全，攻击者可能会修改 http 资源来影响您的站点。
Remember that mixing HTTP and HTTPS is not secure, an attacker could influence your site modifing http resources.