If a server posts a message via HTTPS to another server that does not have HTTPS enabled, will that message still have been sent encrypted?

For example, a message from https://example.com to http://anotherexample.com.

  • 3
    No, it will not.
    – gowenfawr
    Mar 29 '15 at 23:42

No. There's no such thing as a message sent from https://example.com to anywhere; a message is sent from a device, not a URL. A user visiting your site sends messages from their computer to your server, and your server sends messages to their computer; the https in the URL means that they initiated that connection with the HTTPS protocol, and your server (when it receives HTTPS messages) is configured to respond with replies using the HTTPS protocol. If you initiate a connection to http://anotherexample.com from your server, you are initiating a connection from your server to the host of anotherexample.com using the HTTP protocol, which is not encrypted -- it's irrelevant that a user had previously connected to your server with HTTPS, because that's a different connection.

  • Ah, duh. I wasn't thinking about it that way. Thank you.
    – Jerreck
    Mar 29 '15 at 23:50
  • If a JavaScript page received via https were to encrypt some material before sending it via http post, and the nature of the request made replay attacks irrelevant, could such an approach be secure?
    – supercat
    Apr 3 '15 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.