1

I've never encountered this scenario but would the security implications be to such a website?

MMM
  • 111
  • 1

1 Answers1

2

Not really. If the user is on a HTTP non-login page, and clicks on a 'login' button, unlikely he/she is going to notice if the login is now using HTTPs or HTTP.

Best to have the entire site on HTTPs.

Sunil Agrawal
  • 147
  • 3
  • In addition, authentication data for subsequent requests is stored in cookies and are served over plain HTTP. Attacker can sniff them and use to authenticate the user without having to know actual credentials. Something like pass the hash attack. – Crypt32 Nov 30 '17 at 06:12