httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Joshua Slive <jos...@slive.ca>
Subject Re: [users@httpd] SSL / HTML question
Date Mon, 06 Feb 2006 20:47:06 GMT
On 2/6/06, Mark McCulligh <mmcculli@visualtech.ca> wrote:
> If you have a login html (http://www.ex.com/login.html) where the <form>
> action is to a https website (https://www.ex2.com/login_script.php).
> Will the login information be submitted encrypted. Or does the user
> first have to be on to the secure website before loggin in?
>
> Just wondering when you go from http(80) to https(443) when does the
> data start to be secured?

Each request is independent.  So when the user hits the "POST" button,
a new request is started to the https server that will carry the data
encrypted.

But this scheme is subject to man-in-the-middle attacks.  An attacker
with access to the wire could replace login.html with his own page
that looks the same but directs the POST to his own server.   So
unless you have users that always carefully examine the web page
source code, you should make the form ecrypted as well.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message