需要SSL支持我的网站上的Facebook身份验证吗？

Question

I am making a Rails site that lets people sign in, only using Omniauth authentication with Facebook. No passwords are entered into my site. Is it still beneficial to have SSL on my site? Or does the Facebook authentication route pretty much take care of that? I know SSL is required for Facebook apps/sites that appear in FB, and that is NOT my case.

I know it will work, just like I can have a login screen with email/password without SSL. It will work, but it's not exactly secure. I'm looking for a recommendation... if I don't have SSL on my site, what info is passed that would not be secure? And is that info worth having my own SSL certificate to hide it from anyone watching?

Answer 1

部分答案：即使您的应用程序用户启用了安全浏览，也可以在没有SSL的情况下正常运行。

Answer 2

它的ipage，通过HTTPS浏览时显示错误