1

I am making an web application who POST an username and password to an server who checks it. This communication is secure (SSL/TLS).

What I was wondering if the secure SSL communication is set up before or after the first contact with the server?

What I mean is that the POST data is the first data what will reach for the server. Is this data securely send or not? So what is done first the set up of the SSL bridge or does the web app first send the post request?

1

The SSL "bridge" is established first, otherwise all the post data will be sent in cleartext, I am assuming you don't want this.

The whole point of https is to establish a secure connection in a insecure environment, hence we need root authorities that we trust. This is established via trusted certs, public/private keys etc... all done in the background. In other words you do not need the post data to establish the secure connection:)

Hope that helps.

  • Many thanks, I indeed was wondering if I had to do something myself or not ;) . But good to know. – user3892683 Jan 7 '15 at 16:49
  • httsp encrypts your data on the way to the server, but YOU must be sure to be talking to the right server (and not a fake one), first. – Marcel Jan 8 '15 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.