Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html

Now I use a form on this page to do a postback with jquery's ajax functions to the following URL: https://www.example.com/login.aspx (aspx could be anything, mvc, webforms, php, ruby etc).

Is this safe or not? I realize that not the whole session is secure.

Or is this safe, but will browsers complain about it? Will it be safer to use a entirely different domain? https://www.example.org/login.aspx

share|improve this question
    
We can probably guess, but you should be clearer about what you mean by "safe". Safety is a very open-ended property that depends on what you plan to do with the postback, what assets you're trying to protect, what the threats are, what you are vulnerable to, etc. See the faq. –  nealmcb Jul 3 '11 at 16:23
    
This is a duplicate, however since the question is a bit vague I'm not sure which you meant: It's either security.stackexchange.com/questions/258/… or is it security.stackexchange.com/questions/2486/… –  AviD Jul 4 '11 at 23:47
    
Neither really... It's about if a insecured page can make secure ajax calls. –  Rogier21 Jul 5 '11 at 18:34

3 Answers 3

up vote 8 down vote accepted

No, it is not secure and using another domain will not help.

An attacker can manipulate the html/javascript code on the http-page to change the destination of the ajax call to his own server. Or even better, add a second call.

share|improve this answer

Once your browser visits the domain www.example.com and downloads index.html to your browser the entire html is stored on your computer. Since anything stored on the client side can be tampered with this is considered unsafe and you can not trust the data the client is returning from the script supposedly www.example.com served to the user.

This means that login.aspx has to treat every bit of data being sent in as dirty data and clean it up.

Changing domain doesn't do much, and the browser wont complain about javascript is triggering a form on a different domain.

share|improve this answer

Attacks like 'SSL-Stripping' are a clear example of how such approaches could be exploited. This is a vulnerable design.

A plain python-based tool by Moxie to exploit such design: http://www.thoughtcrime.org/software/sslstrip/index.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.