Is it safe to post passwords to my web server in this manner?

NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"];

NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding allowLossyConversion:YES];

NSString *postLength = [NSString stringWithFormat:@"%lu", (unsigned long)[postData length]];

NSMutableURLRequest *request = [[NSMutableURLRequest alloc] init];
[request setURL:url];
[request setHTTPMethod:@"POST"];
[request setValue:postLength forHTTPHeaderField:@"Content-Length"];
[request setValue:@"application/json" forHTTPHeaderField:@"Accept"];
[request setValue:@"application/x-www-form-urlencoded" forHTTPHeaderField:@"Content-Type"];
[request setHTTPBody:postData];

NSError *error = [[NSError alloc] init];
NSHTTPURLResponse *response = nil;
NSData *urlData=[NSURLConnection sendSynchronousRequest:request returningResponse:&response error:&error];

if ([response statusCode] >= 200 && [response statusCode] < 300)
    NSString *responseData = [[NSString alloc]initWithData:urlData encoding:NSUTF8StringEncoding];
    NSLog(@"Response ==> %@", responseData);

My server doesn't have https or any certificates, so is it still safe using the method above?

  • 3
    No. Definitely not. For free SSL certificates, see startssl.com – Luc May 4 '14 at 22:51

No, because they are transported unencrypted over the internet. Even when your app or site is http best practice is to do at least the post containing the username/password using encryption/ssl.

  • Do you know how to do that? – Arian Faurtosh May 4 '14 at 22:29
  • Well it really depends on your server setup. Here's a pretty extensive tutorial for nginx. calomel.org/nginx.html for other setups google is your friend. In general it's not so difficult once you've done it a first time ;) – binaryanomaly May 4 '14 at 22:34
  • Btw. you can get a free cert from startssl.com to start with. – binaryanomaly May 4 '14 at 22:36

The request you send will lack both integrity and confidentiality. That is:

  1. The app can't be sure that its sending the password to the intended server (e.g. an attacker might poison ARP or DNS to redirect requests to their own server) and, in turn, it also can't be sure that the response is genuine.

  2. The password could be disclosed by a 3rd party who intercepted the message (e.g. if the app was being used over an open wireless network).

This is not really any different from a web application that sends a password in the same way. Any data sent in this manner is vulnerable, and the use of SSL/TLS shouldn't be limited to passwords.


No, Use a free certificate authority like letsencrypt.org or startssl.com

You shouldn't send passwords over http because they are vulnerable to a man in the middle attack

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.