通过HTTPS登录路由的方法是否正确？

Question

More of a thinking out loud than a question. I have set my named routes in my route.php file like

Route::get('user/login', array('uses' => 'UserController@login','as' => 'user.login'));
Route::post('user/postlogin', array('https','uses' => 'UserController@postlogin','as' => 'user.postlogin'));

The first route returns a view with a simple login form. The second route is responsible for checking user credentials and redirects to intended routes.
In terms of security do I have to serve over https user/login route also? As a user I am used to see the switch from http to https when accessing login page and I will be really cautious if it wasn't present. However in my app structure user credentials are sent over https through user/postlogin route. Isn't that correct? Am I missing something? I could add https for user/login also but does it really make a difference? Thank you in advance

Answer 1

You don't want the form being intercepted and changed on route to the user, so you need to secure it.

These days, CPU power is not a significantly limiting factor for SSL. Just use SSL for the entire site. Set up the HTTP virtual host to do nothing except redirect to the SSL.

You'll increase your security, benefit your users' privacy, and enhance your SEO.