Re: [users@httpd] SSL / HTML question

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Joshua Slive wrote:

On 2/6/06, Mark McCulligh <mmcculli@xxxxxxxxxxxxx> wrote:
If you have a login html (http://www.ex.com/login.html) where the <form>
action is to a https website (https://www.ex2.com/login_script.php).
Will the login information be submitted encrypted. Or does the user
first have to be on to the secure website before loggin in?

Just wondering when you go from http(80) to https(443) when does the
data start to be secured?

Each request is independent.  So when the user hits the "POST" button,
a new request is started to the https server that will carry the data
encrypted.
But this scheme is subject to man-in-the-middle attacks.  An attacker
with access to the wire could replace login.html with his own page
that looks the same but directs the POST to his own server.   So
unless you have users that always carefully examine the web page
source code, you should make the form ecrypted as well.
Thanks Joshua, just what I wanted to know.

In short what I am doing is I have a couple static websites and one secure website they can login in to manage their website. The clients want the login form on their website and I don't what to purchase multiple SSL just for the login form. The client should alway be logging in on their website for I hope they reallize if they where not on their website. But as we all know users can be stupid or though emails ask you to click here to verify your credit card wouldn't still be out there.

Mark.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx



--
___________________________________________
Mark McCulligh, Web Consultant
VisualTech Components www.VisualTech.ca
mmcculli@xxxxxxxxxxxxx
(519)318-7905


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx



[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux