If a server posts a message via HTTPS to another server that does not have HTTPS enabled, will that message still have been sent encrypted?
For example, a message from https://example.com to http://anotherexample.com.
1
-
3No, it will not.– gowenfawrMar 29, 2015 at 23:42
Add a comment
|
1 Answer
No. There's no such thing as a message sent from https://example.com to anywhere; a message is sent from a device, not a URL. A user visiting your site sends messages from their computer to your server, and your server sends messages to their computer; the https in the URL means that they initiated that connection with the HTTPS protocol, and your server (when it receives HTTPS messages) is configured to respond with replies using the HTTPS protocol. If you initiate a connection to http://anotherexample.com from your server, you are initiating a connection from your server to the host of anotherexample.com using the HTTP protocol, which is not encrypted -- it's irrelevant that a user had previously connected to your server with HTTPS, because that's a different connection.
-
-
If a JavaScript page received via https were to encrypt some material before sending it via http post, and the nature of the request made replay attacks irrelevant, could such an approach be secure?– supercatApr 3, 2015 at 16:57