If you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't.
Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).
Comments
Would a mixed (http + https) site with cookieless http traffic (from a different domain) be secure? Could something like this be included in the spec?
If you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't.
Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).
ahh ok, that's true. Hadn't thought of that. Is there a caching solution that supports https?