Have to deal with some incorrectly assigned/redirected posts from an HTTPS server to HTTP URL's. How much of a security risk are these? Are they vulnerable to something like a man-in-the-middle attack?

  • What do you mean? If you're sending a POST over HTTPS, how could it suddenly transform into HTTP? Where is this HTTP transfer taking place? Do you have a form with a HTTP target URL? – gparent Dec 18 '14 at 22:16
  • BTW, a redirected POST ceases to be one - it'll come through as a GET without the form data. – ceejayoz Dec 18 '14 at 22:22

<form action="http://example.com/"> would post data insecurely, even if the page the <form> is on is itself HTTPS. Data sent in this manner can be intercepted / MITMed.

For the same reasons, <form action="https://example.com/"> on a HTTP page is sent securely. However, the page the <form> is hosted on in this situation can itself be MITMed to inject malicious JavaScript or a changed action that could send the data elsewhere.

If you're working with sensitive data, both the page with the form and the form action need to be HTTPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.