> James Treworgy wrote:
> I would absolutely *not* do this, [mix SSL and non-SSL content]
> unless you want your web site users to see a message from the web
> browser saying "this page has both secure and insecure information.
> Do you want to proceed?" every time they user your site.
> This does not instill confidence.
--- Owen Boyle <[EMAIL PROTECTED]> wrote:
> Good point Jamie. However, for some users this may be necessary,
> there is nothing in the protocol against doing this, the browser
> warnings are browser-dependent (Netscape doesn't give a peep)
Which NetScape? I could swear I got this message from my Navigator a
few times when I was first setting up our site, and hadn't cleared up
the messes....
Our intranet site uses a modperl PerlPostReadRequest handler to reroute
requests that *should* have been on the secure protocol, but doesn't
bother with .jpg's or .gif's or certain directories or pages that are
generally OK. That regularly means pages with mixed content, but the
user never gets those messages.
On the other hand, we're a small enough site (an intranet) that we can
afford the extra performance hit of all the 302's for correcting the
protocol on restricted pages..... On any high volume site, you'd want
to handle it differently, but I think I've seen some posts where
someone suggested mod_rewrite as an option.
Paul
__________________________________________________
Do You Yahoo!?
Thousands of Stores. Millions of Products. All in one Place.
http://shopping.yahoo.com/
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
