1

I am making an web application who POST an username and password to an server who checks it. This communication is secure (SSL/TLS).

What I was wondering if the secure SSL communication is set up before or after the first contact with the server?

What I mean is that the POST data is the first data what will reach for the server. Is this data securely send or not? So what is done first the set up of the SSL bridge or does the web app first send the post request?

1 Answer 1

1

The SSL "bridge" is established first, otherwise all the post data will be sent in cleartext, I am assuming you don't want this.

The whole point of https is to establish a secure connection in a insecure environment, hence we need root authorities that we trust. This is established via trusted certs, public/private keys etc... all done in the background. In other words you do not need the post data to establish the secure connection:)

Hope that helps.

2
  • Many thanks, I indeed was wondering if I had to do something myself or not ;) . But good to know.
    – user56656
    Jan 7, 2015 at 16:49
  • httsp encrypts your data on the way to the server, but YOU must be sure to be talking to the right server (and not a fake one), first.
    – Marcel
    Jan 8, 2015 at 7:43

You must log in to answer this question.