Which paths should you protect?

This page is a summary of community-contributed advice posted at http://www.ubercart.org/forum/support/1850/ssl_which_paths_do_you_protect, and is not to be considered definitive, comprehensive, or complete for any website. In particular, this list does not cover any payment method except for PayPal WPS. It is vital that you research the payment method you're using to ensure that you protect the necessary paths for that payment method. You alone are responsible for understanding the security implications of these settings and making sure that your site is adequately protected.

When you're running in mixed HTTP/HTTPS mode, Secure Pages will protect only the pages you've listed in the "Make secure only the listed pages" text area. As a starting point, you may enter the following list of pages:

user
user/*/edit
user/register
user/login
user/reset*
user/*/order/*
user/*/password
cart/checkout
cart/checkout/review
cart/checkout/payment_details/*
cart/checkout/get_certificate/*
cart/checkout/get_certificate_discount/*
cart/checkout/get_coupon/*
cart/checkout/coupon*
cart/checkout/certificate*
cart/checkout/complete
uc_paypal/ipn/*
uc_paypal/wps/*
uc_paypal/wps/complete/*
cgi-bin/webscr
taxes/calculate
user/autocomplete
filefield/ahah*
filefield/ahah/product/*/*
admin
admin/*
admin/store/order*
admin/store/user*

Some of these could be consolidated, for instance the first 6 lines, all starting with "user", could be written instead as:

user
user/*

However, sometimes you don't want HTTPS on certain pages and would like to exclude them. For instance we've found having HTTPS in the Views admin page can break the Ajax stuff. (Not sure if this has been fixed yet, but for our instances, we had to remove some of the admin HTTPS protection so that AHAH and Ajax callbacks would work, therefore we have to be selective about which paths we protect.)

The path cgi-bin/webscr is in the list because it fixes a bug with the Secure Pages module that mangles your outgoing SSL URL's like the HTTPS URL to PayPal for Website Payment Standard. You need to have this value in the secure URL paths to make Ubercart and Secure Pages play nice and create the secure URL to PayPal.

UPDATE: I've just removed cart/checkout/complete from my list as it was causing the initial invoice emails to be sent out with everything relative to HTTPS.