If you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't.
Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).
Comments
If you used cookies with HTTP-only and secure flags, then cookies alone should be safe, but the site wouldn't.
Someone could sniff login forms via injected scripts (XSS = game over) and modify page's content via unprotected CSS and images (which aids phishing, clickjacking).
ahh ok, that's true. Hadn't thought of that. Is there a caching solution that supports https?