Securing the control panel with SSL

Question

I'm in the process of securing my control panel with SSL using the following rewrite rules

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond $1 ^(member|system) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I'd prefer not to secure the frontend of my website as well, however if an admin visits the frontend of the website over unsecured http while logged in, will this open them up to session sidejacking? If so is there a way around this? Should I be worried?

Answer 1

Really good question. I suppose it could open you up to session sidejacking.

There's a couple of potential solutions I can think of without doing any research or prototyping.

1. If the website is managed by a business, you could make your HTACCESS file only allow access to the control panel for certain IP addresses (yours and their offices). Alongside this, you could make it so that if they are on a (let's call it..) trusted IP all of their browsing is done via HTTPS.
2. You could potentially make it so that if a user is logged in it automatically redirects them to a https version of the page. However, this may be too late and you do risk there being 2 versions of the same page (http and https). Not so great.
3. Perhaps you can move the control panel to a subdomain; such as admin.sitename.com - that way the sessions should be different anyway. I think this is my preferred method.

Let me know how you get in.