forms - 从非安全页面向安全 URL 提交表单

Question

假设我在这个位置的页面上有一个表单...

http://mydomain.com/myform.htm

表单看起来像这样......

<form method="post" action="https://secure.otherdomain.com/handleform.php">
   ....
</form>

假设在接收此表单提交的服务器上安装了有效的 SSL 证书，该表单提交的内容是否会被加密？

Answer 1

POST 请求将通过 HTTPS 传输(如果配置正确则进行加密)。从通过纯 HTTP 获取的页面向 HTTPS 页面提交表单是不好的做法。初始页面也应通过 HTTPS 提供。这样做的原因是 MITM 攻击者可以拦截加载带有表单的页面的响应，并将链接替换为指向另一个目标。

看这里的第一条规则(当然，不是特定于登录页面):

• > https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Use_TLS_for_All_Login_Pages_and_All_Authenticated_Pages

Rule - Use TLS for All Login Pages and All Authenticated Pages

The login page and all subsequent authenticated pages must be exclusively accessed over TLS. The initial login page, referred to as the "login landing page", must be served over TLS. Failure to utilize TLS for the login landing page allows an attacker to modify the login form action, causing the user's credentials to be posted to an arbitrary location. Failure to utilize TLS for authenticated pages after the login enables an attacker to view the unencrypted session ID and compromise the user's authenticated session.