Hacker News Reader

What about a CMS for, say, a blog? You want the administration console to be protected with https, but what about the main pages? Could I make admin.mydomain.com (and have the admin console on that) https only and my domain.com http?

I don't want to buy a cert for the site, but I'd be happy to create a self-signed cert for all the people who can access the admin.

View on HN

> self-signed cert for all the people who can access the admin.

This is what I do. The browser generates a warning on first use, and I then put the domain in the "ignore" list (since I trust my own domain). After that, it works fine.

IANASE, but that should work, so long as you're diligent about keeping everything that requires a login quarantined to a separate subdomain. Once you leak a cookie over to the public side, it's over.

So set the secure flag on the cookie.

It doesn't have to be on a separate subdomain -- setting a secure flag should provide sufficient protection.

Reply on news.ycombinator.com