I have Drupal site with a login form on my home page.
How do I go about posting to a HTTPS url, and then after a successful authentication, redirect back to HTTP admin page?
Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.Sign up to join this community
Given the way things are heading on the internet now, and Google making statements about weighing HTTPS sites higher than HTTP in the past couple of months, you might as well make it totally HTTPS.
You don't want to log in on HTTPS then redirect back to HTTP, you'll have issues with people being logged in and out intermittently. People have tried to address this issue over the years, but I don't think it has ever been solved.
I would set HTTPS always on and handle it in .htaccess, redirecting any non HTTPS traffic to HTTP. (to clarify, you do not need a module to do any of this - just follow the instructions in .htaccess and work with your hosting provider to provide an SSL cert).
If you want to view the /user (login) page on https and you already have a certificate available. Installing the certificate and using the https://www.drupal.org/project/securepages module.
But... when logging in via https i wouldn't recommend redirecting back to https in the admin side of things.
What would be an option, and is possible with that module is, when not logged in just using the secure pages (https) for webforms / login forms etc. (every page that requires user input).
Use Secure Login
For sites that are available via both HTTP and HTTPS, Secure Login module ensures that the user login and other forms are submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in the clear. Secure Login module locks down not just the user/login page but also any page containing the user login block, and any other forms that you configure to be secured.
For Drupal 7 and 8, Secure Login module enforces secure authenticated session cookies, thus preventing session hijacking by eavesdroppers. For previous versions of Drupal, PHP's session.cookie_secure flag must be enabled on the HTTPS site to enforce secure session cookies.
To strictly do what you are asking, I would recommend the secure pages module. You will need to make sure that your web server setup is correctly configured to use https. Contrary to another answer, it is definitely possible and can work quite well, once it is all configured. There are many caveats, though, such as getting sessions to correctly share between http and https.
All in all, though, in this day and age I would heartily recommend to not bother and just run the entire site through https. The overhead of encryption is not a factor anymore with modern hardware, and since it allows the use of http 2, it can actually be faster than plain old http. Also, it is starting to have small SEO benefits to have your site accessible through https (Google has announced over a year ago that they will give pages some extra ranking when they are https).