So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that submits the login for example. So does that mean the page where the link to the login page also must be https to prevent that link to the login page from potentially being compromised?!

This can obviously go on ad infinitum so it sort of suggests the entire site must be https to be truly secure from these types of attacks?

  • This almost looks like a duplicate of the question to this answer stackoverflow.com/a/4515338/363217 – Purefan Feb 1 '16 at 10:30
  • There is a fairly good article from Mozilla available at blog.mozilla.org/tanvi/2016/01/28/… about this specific problem – Matthew Feb 1 '16 at 11:25
  • In addition to serving everything over HTTPS you should also use HSTS. – Anders Feb 1 '16 at 12:55
  • Why the down vote!? People really should explain why they have downvoted to help improve this and future questions... – Sutty1000 Feb 2 '16 at 7:48

... it sort of suggests the entire site must be https to be truly secure from these types of attacks?

Yes, that is exactly the case. All relevant pages on this site (i.e. all in the path to submitting the sensitive information) must be https only, i.e. it should not even be possible to access these pages with http because otherwise tools like sslstrip could be used.

For a nice article on how not to do it and why not I recommend Thank you Waitrose, now fix your insecure site.

  • 1
    Interesting that even banks do not seem to be doing this, eg hsbc.co.uk is http and I can click login from that page. – Sutty1000 Feb 1 '16 at 10:50
  • 3
    @Sutty1000: "Interesting" was this called 5 years ago. Today this is called "incompetence" because you can still access the login page with plain http on this site (i.e. sslstrip would work). – Steffen Ullrich Feb 1 '16 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.