Hi DNN Creative Folks,

I have a DNN site that uses a mix of both SSL and non-SSL pages.  I put SSL required on the Login page, and it does an excellent job of making them use SSL URL's to give protection should users of the site be signing in on less than secure Wireless networks.

...But there's a problem.  The site has a "Remember Me" cookie to encourage convenience and usability with the site.

When someone goes to the site with the "Remember Me" cookie, it doesn't direct them through SSL, as a forced daily login would.  So these users have their tokens transmitted unsecured to the pages they go to.

There are a couple options but none of them great.  So I wanted to run them by here, and see if anyone had any better ideas.

1. I could make every page possible, require SSL.  The problem with this is that there is a large part of the site that is public, and we don't want any of these pages to require SSL, or put extra requirements on them.  Also, there is the concern that the Login Token would be transmitted in an unsecurred manner for the public pages a logged in user might access while Remembered.  So the token would be exposed regardless.

2. We could make a daily sign on.  The problem with this is that it would strongly discourage use of the site.  The site is of general interest, and not an essential web application.  So a password prompt would definitely discourage use.


Is there a way to make SSL be required once someone is considered logged in?  It seems like this is something that might be needed for a lot of DNN sites.  Wondering if the people here have encountered this, and any decent solutions for it.

Thanks!

I think that these are questions worthy of asking over on the DotNetNuke site and, possible, adding as a feature request ... unless someone knows how to do this already.