[SOLVED] When does HTTPS start?

[kael.shipman]

Hey everyone,

 

This might seem obvious, but do you have to establish an https connection before a form is sent, or can you send the form to an https connection and have it encrypted? For some reason, I never looked into this - I just always sent the form to the user via https to be sure - and to be honest it really doesn't matter that much, but I'm just curious.

 

If my question is confusing, here are the contrasting ideas:

 

Is

<!--URL: http://www.bizlunch.net/login.php-->

Please log in!
<form action="https://www.bizlunch.net/login.php" method="post">
...
</form>

 

equivalent to

 

<!--URL: https://www.bizlunch.net/login.php-->

Please log in!
<form action="https://www.bizlunch.net/login.php" method="post">
...
</form>

 

, or is the second one the only way to ensure that the user's information is encrypted?

 

Thanks,

Kael

[trq]

Unless your form itself is accessed via https then the forms contents will be sent as plain text.

[smc]

Well sure you can submit to an HTTPS thats fine but keep in mind the data isn't being encrypted when it is being sent (like thorpe said above, plain text), which kind of defeats the purpose of HTTPS in the first place.

 

Example: Lets say you submitting from login.php to https://login_process.php. The fields from login.php will not be encrypted on its way to the HTTPS.

 

The short of it is, if you can stand to make all the links to the login page under the HTTPS URL, I'd recommend that. If you got SSL, might as well use it.

[kael.shipman]

Cool; thanks.