CODEWITHSUNDEEP
javascriptjquerysecuritypostssl
kamikaze_pilot
kamikaze_pilot

Reputation: 14834

jquery and post method security with an https url

suppose I do

$.post('https://somesite.com', {username : "somename", password : "somepassword"}, function(){
   //do something
});

notice that the site's url is prefixed with https...

Does this imply that jquery will use HTTPS connection to relay that username and password info?

IE. will this prevent some hacker from intercepting that message and obtain the username and password data? IE. is this just as secure as logging in manually with a form in a https enabled site?

If not, what should I do to make this post transmission just as secure as someone manually logging into a site using a login form...(Ie. make it unable to be intercepted by some hacker)

Upvotes: 7

Views: 2546

Answers (2)

Christian
Christian

Reputation: 28125

First, jQuery doesn't do anything. It's plain javascript, and jQuery simply build over it.

Secondly, that will plainly not work, because of cross-domain policy.

Thirdly, there's the issue mentioned by @Rook which is very important IMHO.

Upvotes: 0

rook
rook

Reputation: 67019

Yes the login is fine, but this doesn't guarantee the session is secure. You probably haven't read OWASP a9, and your application is probably vulnerable.

Upvotes: 2

Related Questions