Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a post request is sent from a client on a website without SSL, is the request secure?

For example, I visit a site badsecurity.com, and I login using a password:

  1. Will this password be encrypted if there is no SSL? (I am pretty sure it is not, unless it's https/ssl or there's some other encryption added to the form?)

  2. Is it possible for the post message to get intercepted somehow, say using a packet sniffer, and for the intruder to view the post request's text?

(I am not asking if post requests can be forged)

share|improve this question

1 Answer 1

up vote 12 down vote accepted

No. Not at all. They are sent in plaintext. Without SSL, a POST request is just as secure as a GET request. Sure, it may not show up in the URL, but it is not secure in any way.

Will this password be encrypted if there is no SSL?

No, the password will not be encrypted. The only reason it doesn't show up when you are typing it in is just the browser obscuring it so that people nearby cannot see your password in plaintext on your screen. It can be easily revealed by inspecting the DOM or using some javascript like this: javascript:alert($('input[type="password"]').value) .

Is it possible for the post message to get intercepted somehow, say using a packet sniffer, and for the intruder to view the post request's text?

This is absolutely possible, and very easy to do. A packet sniffer does exactly this, and can view POSTed usernames and passwords in plaintext. To someone sniffing HTTP requests, a POST request looks pretty much identical to a GET request, except a POST request has "POST" at the top instead of "GET."

You didn't ask, but yes, post requests can be forged as well.

share|improve this answer
    
POST a teeeny tiny bit more secure than GET: POST parameters do not normally get logged by HTTP servers, GET parameters do. However, that's like worrying about losing a penny on a day you lost $100000. :P –  Amadan Feb 28 at 3:30
    
If you want to see if your request is 'secure' a good HTTP Proxy is Fiddler - telerik.com/fiddler. This will show you the (unencrypted) data sent with the POST. –  Aaron Newton Feb 28 at 4:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.