Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I could not find a clear answer, but if I have the following situation: I browse to a page let's say

Now I use a form on this page to do a postback with jquery's ajax functions to the following URL: (aspx could be anything, mvc, webforms, php, ruby etc).

Is this safe or not? I realize that not the whole session is secure.

Or is this safe, but will browsers complain about it? Will it be safer to use a entirely different domain?

share|improve this question
We can probably guess, but you should be clearer about what you mean by "safe". Safety is a very open-ended property that depends on what you plan to do with the postback, what assets you're trying to protect, what the threats are, what you are vulnerable to, etc. See the faq. – nealmcb Jul 3 '11 at 16:23
This is a duplicate, however since the question is a bit vague I'm not sure which you meant: It's either… or is it… – AviD Jul 4 '11 at 23:47
Neither really... It's about if a insecured page can make secure ajax calls. – YesMan85 Jul 5 '11 at 18:34
up vote 9 down vote accepted

No, it is not secure and using another domain will not help.

An attacker can manipulate the html/javascript code on the http-page to change the destination of the ajax call to his own server. Or even better, add a second call.

share|improve this answer

Once your browser visits the domain and downloads index.html to your browser the entire html is stored on your computer. Since anything stored on the client side can be tampered with this is considered unsafe and you can not trust the data the client is returning from the script supposedly served to the user.

This means that login.aspx has to treat every bit of data being sent in as dirty data and clean it up.

Changing domain doesn't do much, and the browser wont complain about javascript is triggering a form on a different domain.

share|improve this answer

Attacks like 'SSL-Stripping' are a clear example of how such approaches could be exploited. This is a vulnerable design.

A plain python-based tool by Moxie to exploit such design:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.