Paul,
If you need people to login, then the first page can be served up with http:
The action of the form should be https://myserver.com/cgi/login.pl
This technique is not often used, because the secure icon does not come up
when they are on the login page, only when they have logged in. By setting
the action of the form to https:, it means that the data IS encrypted in
tranmission.
Hope that makes sense
Mike
At 11:15 8/12/2000 -0800, you wrote:
>
>--- Haroon Rafique <[EMAIL PROTECTED]> wrote:
>> Thanks for responding, Paul, Carlos and Michael.
>
>You're welcome. =o)
>
>> Unfortunately, my situation is a catch 22. I will give you more
>> background to help understand my position.
>
>Good idea, lol....
>
>> Here's the current situation:
>>
>> - homepage is http which leads to an https form-based login page.
>>
>> Here's what we want to achieve:
>>
>> - Make the https form-based login page be the actual homepage to
>> eliminate an extra click-thru with a way to silently redirect to
>> http page in the case of non-SSL capapble browser.
>
>Ah! That's a little simpler than I was thinking, actually.
>I think.... ~lol~
>
>> How do other people deal with this scenario? Is there always an http
>> page which leads to the https page to cover the possibility that the
>> user is coming in with non-SSL lynx and at least you could warn them
>> about that on the http page. Any other way out?
>
>Ok. Try this (and I'm hoping more knowledgeable folk will poke holes in
>this where applicable, since they'll probably have better ideas.)
>
>I run my SSL server as a VirtualHost on the same box, but with
>practically the same setup (docroot, etc.), but I think you should be
>able to set up the SSL document root in one location (the https
>form-based login page you mentioned) and the http on port 80 (or
>whatever you're using) document root on the nonsecure info page. If
>someone hits the nonsecure server, it'll give them its page, which
>isn't the same as the SSL login (though it can be named the same, just
>in another directory). If they use https they'll hit the secure port,
>and get the secure docroot's login page.
>
>Holes, anyone? I'm not testing this or rummaging through the
>documentation as I blather, so please don't let me lead anyone
>astray...
>
>Paul
>
>> Thanks,
>> --
>> Haroon Rafique <[EMAIL PROTECTED]>
>>
>>
>>
>______________________________________________________________________
>> Apache Interface to OpenSSL (mod_ssl)
>> www.modssl.org
>> User Support Mailing List
>> [EMAIL PROTECTED]
>> Automated List Manager
>[EMAIL PROTECTED]
>
>
>__________________________________________________
>Do You Yahoo!?
>Yahoo! Shopping - Thousands of Stores. Millions of Products.
>http://shopping.yahoo.com/
>______________________________________________________________________
>Apache Interface to OpenSSL (mod_ssl) www.modssl.org
>User Support Mailing List [EMAIL PROTECTED]
>Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
