Re: Encrypted or Not Encrypted

On Thu, Sep 11, 2008 at 11:25:21AM -0700, amatachick@xxxxxxxxx wrote:
I've run into this issue a few times now and would like to know what
y'all think. Here is the situation: A website not using SSL has a
login page. As soon as credentials are entered on this page they are
redirected to a site using SSL. Here is a specific example of the
code on one such site:

<form name="loginpersonal" method="POST" action="https://secure.sitename.com/engine/login/login.asp"; onSubmit="return checkLoginForm(this);">
<input type=hidden name=IsPostback value=1>

Now, from what I understand, the login credentials would still be
unencrypted while traveling to the secure site. So that would negate
the effect of having it redirect to a secure site in the first place.
Right? I keep brining up this fact but all I get back is that it's
being redirected so it's secure. I feel like I'm taking crazy pills
here so I'd appreciate some feedback. Am I wrong? If I am I can
handle that, I'd just like to know. Thanks!


When the user clicks submit above, the POST request containing the
login information in the form is sent directly to the HTTPS URL in the
"action" field. Redirect wouldn't really be the correct term to use
here... you'd be talking directly to the HTTPS server from the moment
you submit the form in this case.

Ray

Relevant Pages

  • Re: What is the best way to login my website from another website?
    ... IMO *they* should redirect to your site based upon the web service result ... a new login request is issued). ... They are not using those credentials at all at their site? ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to redirect after setting session?
    ... > die(); ... So I moved the code to the top of the page, and the redirect works now. ... When the user clicks on the link to go back to the login page, ... credentials, then clicks submit, the redirect fails with "Cannot find ...
    (comp.lang.php)
  • How do I send authentication data?
    ... I wish to create a login page that prompts the user for a user name ... then uses these credentials to redirect the user to a ...
    (comp.lang.php)
  • Re: Windows authentication after session expiry
    ... In both cases your domain users will not need to login to access the site. ... for Windows Authentication (Should use looged in user's credentials). ... trying to redirect it to Authenticate.aspx. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Encrypted or Not Encrypted
    ... So how are the credentials protected in network transit to the secure site? ... I see the creds being exposed on their way to the secure site. ... Optimally they should enter their creds after ssl has setup the secure session, ... effect of having it redirect to a secure site in the first place. ...
    (Security-Basics)