Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am setting up a login page, and I have some security questions / concerns.

I have a login form (username, password) on a NON-secure page, let's say:

http://www.example.com/login.php 

When the user fills in the form and clicks the "Submit" button, the form POST's a "clear-text" query-string to a secure page:
https://somethingelse.example.com/post.php or https://entirelydifferent.otherdomain.com/post.php

The login form is a standard html form like:

 <form method="post" action="https://somethingelse.example.com/post.php>
   ...
 </form>

So, the "query-string" is clear-text (not obfuscated or encrypted in any way), but I'm sure (I hope) the process of doing a "post" to an "https:" url will encrypt the query-string.

The code in "post.php" validates the username and password in the form data, and redirects to a NON-secure page based on success or fail:
http://www.example.com/success.php or http://www.example.com/fail.php (or perhaps back to http://www.example.com/login.php)

Is this a proper (secure) setup for "https:" login process, or does this cause security or other issues ?

Should one or more of the "http:" pages (login.php, success.php, fail.php) be changed to "https:" (secure) pages ?

Is it an issue (security or otherwise) if the sub-domain or domain changes between the various steps in the example ?

Is it required by the process for certain of these pages to be on the same domain and the same sub-domain ?

Also, it should be noted that I am not handling any critical data like credit card numbers on any pages.

share|improve this question
add comment

1 Answer 1

It is not recommended to collect information from users on non secure page as it will communicate with server on non secure connection.

in your case, whole process should be done on secure connection. Login page, verification page and return page !!

hope it will help ..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.