form submit in a non secure page

views:

answers:

form submit in a non secure page

I would like someone to answer this and if possible provide some reference links to back it up (if possible). Need to prove to someone its not secure.

If I have a form with the post method on a non-secure page, but the action attribute is pointing to a secure URL, is the submitted form secure?

+1 A:

Yes. The data is submitted to a secure URI, so is it is encrypted and secure.

However … the user will have no indication that this is going to happen before they submit the form so you should provide the form over SSL too.

David Dorward 2010-07-26 22:47:57

Indeed, the entire HTTP request (so including the request body / form contents) will be sent over ssl, including headers, which is the reason why you can't have different ssl-certicates for different namebased virtualhosts: the `host` header can only be decoded after the ssl connection has been set up.

Wrikken 2010-07-26 22:50:42

Well then I offer this link. Care to explain your position?http://blogs.msdn.com/b/ie/archive/2005/04/20/410240.aspx

2010-07-26 22:50:48

+1 A:

Short answer is : no secure if ssl(https) is not implemented. Please have a look at my question, and the answers from security guys to that here

Hope this helps.

Michael Mao 2010-07-26 22:54:41

ansaurus

tags:

views:

answers:

form submit in a non secure page

related questions