443 Session 6.x-1.0-alpha2

#D7CX I pledge that 443 Session will have a full Drupal 7 release on the day that Drupal 7 is released.Inspired by a blog post on Cracking Drupal: Drupal and SSL - Multiple Recipes to Possible Solutions, This project is for sites that use mixed security, or HTTPS for some pages and HTTP for the rest. More specifically, all logged in users will use HTTPS for their entire session, while anonymous users will use HTTP.This configuration is often used to balance performance and security as HTTP pages offer much faster response times. Search engine optimization is also another big reason to have mixed security, as SEOs will encourage you to have HTTP rather than HTTPS pages indexed by search engines.A potential issue in using such a configuration is session hijacking. This can happen when a user logs in on a HTTPS page but later navigates to a HTTP page. Under this scenario, the user's session cookie is sent unencrypted and in the clear. A potential attacker can steal this cookie and use it to gain access to the secure pages of the site.This module prevents this from happening by requiring users to use HTTPS for their entire session after logging in. If they navigate to a HTTP page, the session cookie will not be sent. A side affect to this is that they will appear to be logged out while visiting the HTTP page. This module acts to mitigate any confusion caused by this, by implementing a custom access denied handler that notifies the user that they are already logged in, if they try to log in again.The module also implements path management by redirecting user login and registration pages to use HTTPS.When using this module, it is recommended to not use the login block, as it will force all pages containing the block to use HTTPS. Rather, use a menu link to the login page, "user/login".

Requirements:	No special requirements
Platforms:	PHP
Keyword:	Access,  Affect,  Happening,  Logging,  Module,  Navigate,  Prevents,  Requiring,  Secure
Users rating:	0/10