rubycas CAS over ssl, sites over non-ssl
问题 I'm trying to determine how much of a security risk I'm looking at when I have rubycas itself running over https, but my actual sites running under http. the reason I'm faced with this issue is that the sites are deployed on heroku, which means ssl is either really expensive or really a pain. In addition to the login details, i also pass user rolls (authorization) to each site that is then stored in a session. Any input is greatly appreciated. 回答1: The problem with this approach is that