1

I have a form that is on a secure (HTTPS) page, which posts to another page. In the form action, the protocol is not specified but I would assume uses the same protocol as the page that it came from, please see below:

<form id="dummy_form" action="do_action.php" method="POST">
    <input type="hidden" name="some_field" id="some_field">
</form>

The way I have believed this worked is that the relative URL would use the same protocol as the page it is sat on, therefore all traffic is encrypted.

However, I recently had someone contact me saying that the form is insecure and that the information is being transmitted in plaintext. I assume they have just inspected the network traffic using their browsers dev tools (they sent me a screenshot of their data in the network tab of the Google console), but I thought it would be better that I ask the wider community and check?

Better safe than sorry!

Improve this question

1 Answer 1

Reset to default
4

A relative URL as used here will inherit the method and domain and part of the path of the base URL. The base URL is typically the URL you'll see in the browsers URL bar but it might also be changed using the base tag. Thus, if the base URL uses https then the relative URL will too.

Note that the base tag might actually specify a different method than the URL actually loaded (and which is shown in the URL bar). In the following example the form will be submitted over plain HTTP even if the page was originally loaded using HTTPS and is shown as such in the URL bar:

<!doctype html>
<base href=http://example.com/> <!-- plain HTTP in base URL -->
<form action=submit.php> <!-- will be submitted with plain HTTP -->
...
</form>

This means just looking at the particular part of the source code and to the URL in the URL bar is not sufficient to determine which method will actually be used to submit a form.

Improve this answer
1
  • Fortunately my code doesn't use a base tag - thank you for the in-depth answer and for the "extra" bit about base tags, something I hadn't seen before.
    – Aphire
    Nov 20, 2019 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .