A little background information. I have a client that has two customer facing web applications, one is a public website and the other a customer site which requires authentication. This is two applications as one is based on third party code and the other is in-house code. The sites are in the same domain e.g. foo.com but different subdomains e.g. www.foo.com and bar.foo.com.
My problem is that the wise people in the marketing department believe that there may be an issue due to the different addresses - the issues are non-technical and related to customer trust. I have been asked to supply alternatives. One is to have one of the applications available on http and the other on https i.e. accessed over different ports on the same address i.e. http://www.foo.com and https://www.foo.com. Whilst this is possible to set up it feels like a horrible solution and I am trying to get as many objections to it is as possible.
Are there any standards or best practises which advise against this? What issues would people expect my current ones are:
My problem is that the wise people in the marketing department believe that there may be an issue due to the different addresses - the issues are non-technical and related to customer trust. I have been asked to supply alternatives. One is to have one of the applications available on http and the other on https i.e. accessed over different ports on the same address i.e. http://www.foo.com and https://www.foo.com. Whilst this is possible to set up it feels like a horrible solution and I am trying to get as many objections to it is as possible.
Are there any standards or best practises which advise against this? What issues would people expect my current ones are:
- People navigating to the wrong site as most don't type the protocol
- Buggy behaviour - switching between the applications unintentionally