从 HTTPS 重定向到 HTTP 的安全问题？
我在一些博客上读到（很抱歉没有提及参考资料，但我再也找不到它），如果您将用户从 https 页面重定向到一个 http 页面。
那么，有人可以向我解释一下，在以下情况下我是对还是错：
在登录页面上使用 https，然后使用 http 将他重定向到管理页面是否是正确的做法，或者这会创建安全性诸如 Session Fixation 劫持、窃取会话等问题？
或者我必须将管理页面也保留在 https 中吗？
问题的另一方面是：https 允许缓存静态文件吗？
我在这里读过其他文章，但我仍然很困惑，因为有些人说“是”，有些人说“不”；也有人说这取决于浏览器。
I have read on some blog (sorry for not mentioning the reference but I can't find it anymore) that you will lose all your work on securing your site if you redirect a user from an https page to an http page.
So, could someone please explain to me if I am right or wrong here in the following scenario:
Is it right practice to use https on the login page then redirect him to Admin Page with http, or will this will create a security issue like Session Fixation hijacking, stealing session, etc.?
Or must I keep the Admin Page also in https?
Another side of the question is: will https allow caching of static files?
I have read other articles here but I am still confused as some say 'yes' and some say 'no'; also some say it depends on browser.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
在您的实例中（仅使用 HTTPS 保护
登录页面），虽然登录详细信息将受到保护（例如用户名/密码），但您的用户将容易受到会话劫持。使用 HTTP/HTTPS 混合还是完整 HTTPS 取决于您的情况。例如，亚马逊将使用 HTTPS 进行登录，但您将使用 HTTP 浏览网站，但一旦您进入敏感区域（订单详细信息屏幕、更改帐户/密码详细信息等），它就会切换到 HTTPS 并询问您重新进行身份验证。 从 HTTP 切换到 HTTPS 后重新验证用户身份是阻止会话劫持的关键，因为您实际上是在发出新的会话令牌。因此，如果用户窃取会话令牌，他们仍然不会窃取会话令牌拥有您的用户名/密码，但无法访问您的帐户部分。
如果管理区域特别敏感，则只需使用 HTTPS 即可完成整个操作。 Google 发现使用完整 HTTPS 的 CPU 开销在 1-5% 之间，基本上几乎没有什么开销。
至于在 HTTPS 上缓存静态文件，我不确定，但是这篇 SO post 建议它会正常缓存 网络浏览器是否会通过 https 缓存内容
In your instance (in only securing the
loginpage with HTTPS) while login details will be protected (e.g. username/password), your users will be susceptible to Session Hijacking.Whether you use a mixture of HTTP/HTTPS or full HTTPS depends on your situation. Amazon for instance, will use HTTPS for the login, but you'll browse the site with HTTP, but as soon as you go to a sensitive area (Order details screen, change account/password details etc.) it switches to HTTPS and asks you to re-authenticate. Re-Authenticating the user after switching from HTTP to HTTPS is the key to stop Session Hijacking because you're effectively issuing a new Session token. So if a user steals the session token, they still don't have your username/password and can't access your account section.
If the admin area is particularly sensitive then just HTTPS the whole thing. Google found the overhead from using full HTTPS was between 1-5% overhead on the CPU, hardly anything basically.
As for caching static files on HTTPS I'm not sure, but this SO post suggest it'll cache as normal Will web browsers cache content over https
一切都必须与 https 一起使用。如果你切换到http，每个人都可以看到正在发送的内容，这意味着你提到的那些安全问题就会出现。
原因是您必须识别您的客户才能在您的管理站点中分配访问权限。这样做的一种可能性是发回一个令牌（一些哈希值或其他）。根据令牌，您知道它是否是经过身份验证的客户端。但其他人确实看到了这个标记 =>安全问题。
当然，您可以使用之前的 https 会话来交换私钥。并用它以某种方式加密你的 http 内容。但这是一个坏主意，因为 https 可以更方便地做到这一点。
Everything must be used with https. If you switch over to http, everybody can see the content being sent, which means those security issues you mentioned will emerge.
The reason is that you have to identify your client in order to assign access rights in your admin site. One possibility to do so, is sending back a token (some hash or whatever). Depending on the token you know if it's an authenticated client or not. But everybody else does see this token => security issue.
Of course you could use the previous https session to exchange a private key. And use it to encrypt your http stuff somehow. But this is a bad idea, since https does this much more conveniently..