1

It is known that:

In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL)

(Source)

My question is: having a simple HTML login form hosted on an HTTPS enabled server, when the user enters the address starting https:// does the browser automatically encrypt the login data (login and password) thus allowing for secure communication (i.e., the browser sees the HTTPS protocol and understands that the data to send has to be encrypted)?

1
  • In addition to the information conveyed by Wayne regarding how communication over https with an SSL certificate installed (which hopefully you have) works, as long as the form action also posts to an https URL or relative URL, the data will be transmitted securely by the browser. How you chose to store and check that data securely is another matter...
    – dan
    Dec 11, 2022 at 6:42

1 Answer 1

2

The communication process is a bit complicated so critical encryption keys are never exposed, but the data is sent after the point of a shared secret key. It is still best practice to not assume a login attempt will never be attempted on the un-encrypted port of 80. But this lack of the assumption the data is encrypted is a backup precaution to insure security for the client.

It should be noted that it is possible for a browser to negotiate a no-encryption standard to the server. SSL.com strongly recommends you not do this but it is a possibility. Banks would of course not support a no-encryption protocol on their servers.

At the early stage ...

  • The client browser and the web server exchange "hello" messages. Note port 443 is an SSL port so this hello is nothing more than a connection.

  • Both parties communicate their encryption standards with each other.

  • The server shares its certificate with the browser.

  • The client verifies the certificate's validity.

So the initial communications from the browser to the https port is a request for the public certificate. Not user data. A shared secret key is computed from the public keys using the private keys, which is understood and agreed by both, and user data is then sent encrypted by this shared secret key, which is only known by these two computers and used for the session.

The more detailed communications are ... And, note there are two servers involved your site and the certificate authority.

enter image description here

The only potential non-encrypted information (beyond IP numbers) is the DNS request for the site name, but the client, (browser), can use an encrypted DNS service which encrypts that information as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.