title: Preparing my ASP.NET / MVC site to use SSL?
body: <p>I'm getting ready to have an <code>SSL cert</code> installed on my hosting. </p>
  
  <p>It is my understanding that (and correct me if I'm wrong...):</p>
  
  <ol>
  <li><p>Once the hosting guys install the cert, I will be able to browse my site on <code>Http</code> or <code>Https</code> (nothing will stop me from continuing to use Http)?</p></li>
  <li><p>The only thing I need to do, is add logic (in the case of MVC, Controller attributes/filters) to force certain pages, of my choosing, to redirect to <code>Https</code> (for instance, adding a <code>[RequiresHttps]</code> attribute sparingly).</p></li>
  </ol>
  
  <p>Do I have to worry about doing anything extra with these things to make sure I'm using <code>SSL</code> properly? I'm not sure if I need to change something with logic having to do with:</p>
  
  <ol>
  <li><p>Cookies</p></li>
  <li><p>PayPal Express integration</p></li>
  </ol>
  
  <p>Also, I plan on adding <code>[RequiresHttps]</code> only on the shopping cart, checkout, login, account, and administration pages. I wish to leave my product browsing/shopping pages on <code>Http</code> since I heard there is more overhead for using <code>Https</code>. Is this normal/acceptable/ok?</p>
  
  <p>One more question... I know ASP.NET stores some login information in the form of an Auth cookie. It is okay that a user logs in within an <code>Https</code> page, but then can go back and browse in an <code>Http</code> page? I'm wondering if that creates a security weakness since the user is logged in and browsing in <code>Http</code> again. Does that ruin the point of using <code>SSL</code>?</p>
  
  <p>I'm kind of a newb at this... so help would be appreciated.</p>