CODEWITHSUNDEEP
formssecuritysslhttps
jessegavin
jessegavin

Reputation: 75690

Submitting a form to a secure url from a non-secure page

Suppose I have a form on a page at this location...

http://mydomain.com/myform.htm

And the form looks like this...

<form method="post" action="https://secure.otherdomain.com/handleform.php">
   ....
</form>

Assuming that there is a valid SSL cert installed on the server which receives this form submission will the contents of that form submission be encrypted?

Upvotes: 2

Views: 3393

Answers (3)

user121356
user121356

Reputation:

Assuming a valid SSL/TLS session can be negotiated between the server and the client, then yes. This means that the client must be willing to trust whatever certificate the server presents and that the two parties can negotiate a mutually-agreeable cipher set (what algorithms to use, etc). There are plenty of configuration options you can set to alter what is allowed, but in a "normal" implementation where you don't go messing around with requiring a specific, non-normal, algorithm, requiring client-side certificate authentication, etc, everything should work just fine and you'll have a protected session...and if it fails for some reason, you'll know as your client will receive an error about what went wrong.

Note that, in general, while you can do this, and the transmission would be encrypted, you generally should not. Having an unencrypted/protected page submit to one leaves you vulnerable to a couple types of Man in the Middle attacks. You can see the OWASP article on this, and why it's bad, here.

Upvotes: 3

Bruno
Bruno

Reputation: 122749

The POST request will be transmitted over HTTPS (so encrypted if configured properly). Submitting a form from a page obtained over plain HTTP to an HTTPS page is bad practice. The initial page should also be served over HTTPS. The reason for this is that a MITM attacker could intercept the response that loads the page with the form and replace the link to point to another target.

See the first rule here (of course, not specific to login pages):

Rule - Use TLS for All Login Pages and All Authenticated Pages

The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the "login landing page", must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session.

Upvotes: 6

Bryan Naegele
Bryan Naegele

Reputation: 660

Yes. It will be transmitted securely.

Upvotes: 0

Related Questions