4

I'm in the process of securing my control panel with SSL using the following rewrite rules

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond $1 ^(member|system) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I'd prefer not to secure the frontend of my website as well, however if an admin visits the frontend of the website over unsecured http while logged in, will this open them up to session sidejacking? If so is there a way around this? Should I be worried?

2

Really good question. I suppose it could open you up to session sidejacking.

There's a couple of potential solutions I can think of without doing any research or prototyping.

  1. If the website is managed by a business, you could make your HTACCESS file only allow access to the control panel for certain IP addresses (yours and their offices). Alongside this, you could make it so that if they are on a (let's call it..) trusted IP all of their browsing is done via HTTPS.
  2. You could potentially make it so that if a user is logged in it automatically redirects them to a https version of the page. However, this may be too late and you do risk there being 2 versions of the same page (http and https). Not so great.
  3. Perhaps you can move the control panel to a subdomain; such as admin.sitename.com - that way the sessions should be different anyway. I think this is my preferred method.

Let me know how you get in.

| improve this answer | |
  • Thanks for the suggestions. I like the subdomain approach however I'll probably go with limiting access by IP address as I don't have a wildcard SSL certificate. – Dylan Feb 28 '13 at 6:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.