Hi,
yes, i read this page, according to the diagram, i see it's necessary to send the username and password at least once, then the LS server send to the cliente a session_id.
if you check the image on page 15 (attached) you'll see that the first request from the client goes to the web server not to Lightstreamer server. Such request can be a https request that contains the user and password.
You will authenticate the user on your web server. The web server will send its session id to the client in some way (usually within a cookie).
This first part has no relation with Lightstreamer, is just a classic web authentication.
Once the client is authenticated on the web server it will open the stream connection to Lightstreamer server but, instead of sending user and password to such Lightstreamer server, it will send user and the session id generated by your web server.
The metadata adapter will receive such info and will in turn communicate with your web server to ensure that the user/session id pair is a valid one and in such case will enable the streaming session.
So, no password is sent to the Lightstreamer server, only the user and a session id generated by your web server.
about the SSL connection, is there any way to send the information with https?? regardless that the master push page has been dowloaded through https or not.
no, you can open an https streaming session only from a https page