Home / server / Questions / 268571
Accepted
Ian Burris
Asked: 2011-05-12 05:24:52 +0800 CST

Should http and https requests access the same files

  • 772

Is it ok to have http and https requests point to the same directory such as var/www/? It seems like it would be alright since when you're say authenticating a user you can just make sure to call https instead of http. However I can see how a malicious user could use javascript to change the https url to a http url. If it's best to split them between two directories any recommendations on how to do this with a framework since you would have to duplicate a lot of code between the directories?

ssl directory

2 Answers

  1. Best Answer

    I suppose it would depend on your setup, but most configurations I've seen point them to the same place.

    Also, mu:

    1. If JS changed the protocol, a security warning would popup about mixed data confidentiality levels.
    2. If JS can change the protocol you're using, it can also redirect any sensitive information it finds wherever it pleases; it's already game over.
    • 2

  2. If you have data that needs to have its confidentiality or integrity (during transport) protected it would seem to me that not even making it capable of being available via an unencrypted protocol would be prudent. Relying on browser behavior to warn the user that they're receiving content via an unencrypted channel is likely to just be ignored anyway.

    How you handle this with your particular framework isn't something I can say w/o knowing more. I wouldn't want any duplication of code but, if I had to, I'd probably symlink the relevant directories.

    • 2