-1

We would like to have HTTP posts from secure servers be secure on our end.

Do the posts need to be made to https://ourserver.com, or does it work to post to http://ourserver.com, and then redirect to https via htaccess?

It would be nice if the latter were true in some fashion, as we're looking at 100's of URL's that would need to be updated manually.

1 Answer 1

5

You should post directly to an https: URL.

User agents do not resubmit the POST request if the response was a 301 or 302. And while the 307 status code can be used to indicate that the POST request should be resubmitted, most user agents do not support it.

2
  • Thanks. I hadn't even considered that aspect. If the user agent was able to resubmit the post, would the first post even have been secure?
    – beej
    Dec 17, 2014 at 7:18
  • 1
    No, clearly not. Dec 17, 2014 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .