Admin Login Using https or http

[PatG]

I have an SSL cert installed.
I am still able to login to the backend on the http url.
It doesn't force over to https.
Is the backend just have vital pages under https?
And non-vital pages under http?

Or should I be logging in to the start page as the admin using https?

[Jim]

You should log in to your backoffice with the http:// domain name. When you go to a screen that needs to be secure you will be prompted to log in to the secure url.

Using a secure url requires that all data in the transmission be encrypted so it takes additional server resources as well as more band width in the connection to do things securely.

[PatG]

I'm not used to things being so well thought out and executed!

[MgmtSpec]

Not encrypting your main entry opens you up to the REMOTE possibility of a packet sniff hack of your access credentials. With those a bad guy could do a lot of damage and if you use credit cards you may violate compliance. We make all our clients use the secure login. A little more resource is worth the security - in my opinion.

[PatG]

Is it just a choice (for me to make) to use http or https here that you're referring to? Or are you saying that ShopSite would have to do something?

Seems to me that packet sniffer intercept may still be a vulnerability even with https, if someone has access to my local network or station. Am thinking if they have that, they'd get me with a keylogger and skip the sniffing.

[MgmtSpec]

ShopSite does not need to do anything. You would need to add SSL to your server/domain. If someone interecepted a packet via SSL it would be encrytped - that's the difference. Yes, encryption can still be cracked but now its a lot more difficult task.

Keystroke logger is a local issue, we have to assume you can control your own network reasonbly.

Unless you have ShopSite ON your LOCAL network, the information is being passed over the internet. Email, etc is all passed over the open internet. Since most used a hosted version, I assumed you were too.

[PatG]

I've got the SSL cert installed, but when I log into the https page (/ss/start.cgi), then click a non-https page (like the merchandising tab), it prompts me to login again, back to sending unencrypted login creds...

Am I missing something?

[loren_d_c]

If you want all of the backoffice menus to use https://, go to Preferences -> Hosting Service menu and change the 'Merchant CGIs URL' to use https:// instead of the usual http://

-Loren

[PatG]

Perfect!
Switched it to https, works great!
Thank you!!!