On Fri, Oct 21, 2011 at 7:33 AM, Brandon Wirtz <drak...@digerat.com> wrote:

> IE5/IE6 will say page cannot be displayed and will never connect.  For
> this reason you should encourage users to arrive at a non-HTTPs version of
> the page, do browser detection and display an Upgrade your browser
> notification, then use the login to take them to the secure version of the
> site.
>

Doing this will make your users vulnerable to man-in-the-middle attacks: an
attacker could intercept the HTTP request and send back HTTP responses,
with no redirect to HTTPS.

How plausible this is depends on the nature of your app, naturally.

-Nick Johnson


> ****
>
> ** **
>
> ** **
>
> ** **
>
> *From:* google-appengine@googlegroups.com [mailto:
> google-appengine@googlegroups.com] *On Behalf Of *Nick
> *Sent:* Thursday, October 20, 2011 1:13 PM
> *To:* google-appengine@googlegroups.com
> *Subject:* [google-appengine] Re: Announcing SSL for Custom Domains
> Trusted Tester Program****
>
> ** **
>
> What happens when a non-supported browser attempts to access
> https://www.my-sercure-appengine-app.com? Does it redirect to http:// or
> show an error dialog? ****
>
> --
> You received this message because you are subscribed to the Google Groups
> "Google App Engine" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/google-appengine/-/DUTj6iVJ49gJ.
> To post to this group, send email to google-appengine@googlegroups.com.
> To unsubscribe from this group, send email to
> google-appengine+unsubscr...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-appengine?hl=en.****
>
> --
> You received this message because you are subscribed to the Google Groups
> "Google App Engine" group.
> To post to this group, send email to google-appengine@googlegroups.com.
> To unsubscribe from this group, send email to
> google-appengine+unsubscr...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-appengine?hl=en.
>



-- 
Nick Johnson, Developer Programs Engineer, App Engine

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To post to this group, send email to google-appengine@googlegroups.com.
To unsubscribe from this group, send email to 
google-appengine+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/google-appengine?hl=en.

Reply via email to