Home/ Questions/Q 194699
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T16:37:04+00:00

I roamed the site for this question using the search engine, and I don’t

  • 0

I roamed the site for this question using the search engine, and I don’t think it’s out there. If it is, apologies in advance and feel free to point me to it.

Here is my scenario:

I am setting up a web application, Moodle if anyone is familiar with it, with Apache, MySQL, and php on Windows. Moodle supports enabling SSL for login, but then reverts to regular http after login is established. This is running on an internal network with no connection to the outside world, so no Internet access through this network. All users who use the network have logins, however there are some generic guest type logins with certain restricted privilages. Currently the MySQL database is not encrypted.

My question is this:

If my users do an SSL login, and the system then reverts back to http for the remainder of their session, how vulnerable is the data that is transferred back and forth between the browser interface and the database?

I would perhaps prefer to have all the data encrypted, but I am not sure how bad the performance hit would be to do that, so any suggestions concerning that would be appreciated too. Although I will be extending the functionality in Moodle, I don’t necessarily want to have to change it to encrypt everything if already does.

I am new to the world of IT security, and my DBA skills are rusty, so if you give me an answer, type slowly so I can understand! 😉

Thanks in advance!
Carvell

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    A few things.

    1. The fact that the data in the DB server is not encrypted in no way is a factor in the communication between the User and the Web Server. It is a concern obviously for communications between the web server and the database server.

    2. Your risk point between user and web server is in that packets could be sniffed if a person was able to interject in the middle of the communication chain. However, this risk is mitigated by the fact that your on an internal network.

    Therefore, unless you are VERY concerned about the other people in your organization, you are more than likely ok. However, if it is really sensitive data, you might do ALL communications via SSL to ensure that it is transmitted securely. IF you are this concerned, then I would also look at the security of the DB and the communications from DB to webserver.

    • 0