Secure jquery ajax calls from a non secure page

Question

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html

Now I use a form on this page to do a postback with jquery's ajax functions to the following URL: https://www.example.com/login.aspx (aspx could be anything, mvc, webforms, php, ruby etc).

Is this safe or not? I realize that not the whole session is secure.

Or is this safe, but will browsers complain about it? Will it be safer to use a entirely different domain? https://www.example.org/login.aspx

Answer 1

No, it is not secure and using another domain will not help.

An attacker can manipulate the html/javascript code on the http-page to change the destination of the ajax call to his own server. Or even better, add a second call.

Answer 2

Once your browser visits the domain www.example.com and downloads index.html to your browser the entire html is stored on your computer. Since anything stored on the client side can be tampered with this is considered unsafe and you can not trust the data the client is returning from the script supposedly www.example.com served to the user.

This means that login.aspx has to treat every bit of data being sent in as dirty data and clean it up.

Changing domain doesn't do much, and the browser wont complain about javascript is triggering a form on a different domain.

Answer 3

Attacks like 'SSL-Stripping' are a clear example of how such approaches could be exploited. This is a vulnerable design.

A plain python-based tool by Moxie to exploit such design: http://www.thoughtcrime.org/software/sslstrip/index.html