posting a form from one HTTPS to another HTTPS site causing security alert

Question

I need to post a string from a .NET site to a Classic ASP site which are hosted on the same server (different virtual directories).

https: //example.com/DOTNETSite/Sender.aspx

to

https: //example.com/ClassicASP/SomeFolder/Target.asp

Target.asp page has 3 ways to handle incoming data:

1. Form Post
2. Query String
3. Headers

I cant pass my data in query string. so that option is out. I am trying the Form post method by building a form on the server side and spitting out javascript code to do a form.submit(). But this is causing a internet explorer to throw a Security Alert for the user. We want to avoid this. Please let us know what is the best way to overcome this situation. Thanks a ton.

Answer 1

Right now you are doing:

your server ----> your client/browser ----> their server

Instead you should use:

your server ----> your client/browser ----> your server ----> their server

That is (if it wasn't clear enough), make it send the form to your own server. When your server receives the form, it should send it to the target server.

On a basic level, this works. However, you may get issues if the user is supposed to be logged in on the 2nd server etc.

I'll try to illustrate an example in PHP:

File: form.html

<form action="send.php" method="post">
    ....
</form>

File: send.php

<?php
  $url='https://example.com/ClassicASP/SomeFolder/Target.asp';
  // create new cur connection
  $ch=curl_init();
  // tell curl target url
  curl_setopt($ch, CURLOPT_URL, $url);
  // tell curl we will be sending via POST
  curl_setopt($ch, CURLOPT_POST, true);
  // tell it not to validate ssl cert
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  // tell it where to get POST variables from
  curl_setopt($ch, CURLOPT_POSTFIELDS, $_POST); 
  // make the connection
  curl_exec($ch);
  // close connection
  curl_close($ch);
?>