<input type="text" name="username">
(just ignore the fact that inline event handlers aren't actually a good choice - that's just for the sake of the example). The page is served over HTTP but of course the
secure_submit function sends your data over
https, so you're good to go, right?
Well, not quite. What if the user has
GET request and whatever I put inside the input fields will end up in URL parameters, therefore ending up in the logs of who-knows-how-many servers in between my computer and the application.
Which is just the long way of saying: even with the details you mentioned, a form served over an
HTTP connection can still result in credentials being sent in the clear. To completely avoid the risk of that you would have to do one (or more) of the following things:
- Serve the page over HTTPS
- Specify an action
- Remove the name from the input elements (the browser will no longer include them in the form data)
As for whether or not this is a false positive, it is quite possible, but I'm having a hard time coming up with a comprehensive answer based on your description. Hopefully though the above discussion will help you figure that out yourself.