4

I have a website residing on a domain with a valid SSL certificate that is fully using HTTPS. If I take form data from this site that is secured with an SSL and send it to a non-secure HTTP endpoint using a cURL POST is the transmission fully encrypted considering it's going from an HTTPS site to an HTTP endpoint?

  • 1
    Definitely not. Cloudflare is the easiest way to get the other site SSL-encrypted. – Housemd May 29 '18 at 14:35
6

Short answer: no, it is not encrypted.

The only thing that matters is the URL you are using to send content, what happened before is irrelevant.

If you are sending your content to an HTTP URL then it is not encrypted, end of story (except some rare corner cases that you should not rely on, like HSTS preloading where a browser would automatically do an HTTPS request instead).

  • Thanks. I suspected this was the case, but wanted to make sure before I did it! – AndyWarren May 29 '18 at 18:00
  • 1
    @AndyWarren If you want to be sure (in general), launch a network scanner such as Wireshark on your computer to see what goes out, and click Send to see what is posted on the wires. – Patrick Mevzek May 29 '18 at 18:02
  • "like HSTS preloading" - although the OP is using a cURL server to server request, so any "HSTS preloading" in the browser would not apply here anyway. – MrWhite May 31 '18 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.