1

If I have a form on a HTTPS site and my processing page (which is also HTTPS) is on a completely different domain, will the data be secure?

For example: https://example.com has a form with action="https://processingpage.com" is there any risk with the data that is sent from the form?

Can it be intercepted? Does it have to be encrypted?

2

In the situation you described the data is transported securely and cannot be intercepted between the two domains.

However, it may be harder to implement something to prevent cross site request forgery in your situation.

0

There is nothing really wrong there, but as you change domain, you loose the notion of session which only makes sense on one single site. And you cannot prevent other sites to include a copy of your form (same fields) and post the result to your processing site with potentially unexpected values.

That being said, as both the form and the processing page are HTTPS, the exchange is as much secure as permitted by HTTPS. You can read this other question if you want to know more on HTTPS limits.

  • Thanks. To clarify there would be no chance of the data being intercepted between the two domains? – Sam Allen Dec 8 '16 at 7:43
  • @SamAllen:neither more nore less than in a single domain use case... – Serge Ballesta Dec 8 '16 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.