2

There is already couple of questions regarding this behavior

None of them explains why developers of browser X design the browser's behavior to reset HTML forms upon hitting the back button for pages viewed over HTTPS connection. Anything related to security here? or it's just because using HTTPS suggests that data is very sensitive?

3
  • 1
    This question is discussed/answered here: stackoverflow.com/questions/1485672/… For data that require encryption, the back button could reveal such data to a third party if the browser were left unattended after submitting a form.
    – Bob Brown
    Jan 19, 2015 at 17:19
  • 1
    I don't see the answer, "most browsers will automatically reset form upon hitting back button for pages viewed over HTTPS connection regardless of their normal behavior for HTTP connections." my question is what is the motive behind such behavior? is it related to security?
    – Ulkoma
    Jan 19, 2015 at 17:21
  • See my remark above.
    – Bob Brown
    Jan 19, 2015 at 19:58

1 Answer 1

2

Some times, form data may be dynamic. Example, only when you select a country, the drop-down to select a state will be enabled. Now to actually know what values need to be filled in the "state" menu, the information about the "country" you just selected will be sent to the server. server will then send to the client, a list of all states that come under the country and will populate the drop-down menu.

Now, all these exchange of information between the client(web-browser) and server are done via encrypted channel using SSL. When You click on the "back" button, the current SSL session becomes invalidated. And all data exchanged over that session must no longer be valid. Even if you want to have the same values again when you visit the page next time, those values need to be communicated via a channel secured using a different session key.(i.e, a new SSL handshake will be initiated, resulting in new pre-master, master and session keys and the HTML form data will be encrypted with new keys.)

So, to prevent the data of old SSL session to be used in the current SSL session, the form data will be cleared.

Note that sometimes, cookies and session tickets will be used to retain the form data/session keys. But servers generally dont support session tickets, rather they encourage having a separate session.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .