我的表格安全吗？
我有一个 4 步表格流程。
- form.phpvalidation.phpreview.phpcomplete.phpForm.php
- 到validate.php，根据
- 发布
- 。
验证重定向回form.php或review.php 最后一步是complete.php
每个页面都使用HTTPS 进行调用，除了validate.php 之外，validate.php 是创建SESSION 变量的地方，然后重定向回调用https 的form.php 或review.php。
浏览器上的锁永远不会消失，但有人告诉我，如果您发布到相对路径（未显式调用 https），则表单不安全。
这是真的吗？我安全吗？有没有办法检查和/或证明表单流程是否安全？
有人告诉我它是安全的，但我只是想确定一下，所以我不承担任何责任。
我在表单帖子上使用相对路径，因为使用 HTTPS 显式调用页面时不会创建 SESSION 变量。如果有人有一个潜在的解决方案，那就太好了。
I have a 4 step form process.
- form.php
- validation.php
- review.php
- complete.php
Form.php posts to validate.php which depending on the validation redirects either back to form.php or to review.php. The final step is complete.php
Each page is called with HTTPS except validate.php which is where the SESSION variables are created and then redirects back to form.php or review.php calling https.
The lock on the browser never disappears but I was told if you post to a relative path (not calling https explicitly) the form is not secure.
Is this true? Am I secure? Is there a way to check and or prove that the form process is secured or not?
Someone is telling me it is secure but I just want to be sure so I am not liable.
I am using a relative path on the form post because the SESSION variables aren't created when the page is called explicitly with HTTPS. If anyone has a potential solution for that that would be great as well.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
即使没有明确发布到，例如 https://your-server.com/validate.php ，事实上您使用的是相对链接（例如action="validate.php"），这意味着它的每一步仍然使用HTTPS。
简短的回答 - 相关链接上的协议不会改变。因此，如果 form.php 不是 HTTPS，则表单变量将无法通过相对链接安全提交。
Even though are not explicitly posting to, for example, https://your-server.com/validate.php, the fact you are using a relative link (e.g. action="validate.php") means it is still using HTTPS every step of the way.
Short answer - the protocol doesn't change on relative links. So if form.php is not HTTPS, the form variables will not be submitted securely with a relative link.
那是垃圾。相对 URI 是相对 URI，不会导致协议发生更改。
如果页面是通过 HTTPS 请求的并且 URI 是相对的，则下一个请求也将使用 HTTPS。
您一定是误诊了问题。浏览器在内部将相对 URI 解析为绝对 URI。发送的数据没有区别。
That is rubbish. A relative URI is a relative URI and doesn't cause a change in protocol.
If the page was requested via HTTPS and the URI is relative, then the next request will also use HTTPS.
You must be misdiagnosing the problem. Browsers resolve relative URIs into absolute URIs internally. There is no difference in the data sent.
如果您将数据发布到浏览器或将信息发送回用于完成来自 validate.php 的事务的浏览器，并且没有使用 HTTPS 传输数据，那么您的应用程序中可能存在漏洞。如果使用相对路径从通过 HTTPS 加载的页面调用 validate.php，则默认情况下它将使用 HTTPS——如果未明确指定，相对路径将继承协议、主机名和端口。
然而，这并不意味着您的页面是安全的。这意味着正在发送的数据正在被加密。即使使用 HTTPS 传输数据，您仍然可能遇到一些需要处理的问题（弱密码、SQL 注入、跨站点脚本编写等）。如果您使用 HTTPS，至少您的数据传输将更难以拦截或欺骗。
If you have data posting to or are sending back information to the browser that is being used to complete the transaction from validate.php and are not using HTTPS for the data, then you have a potential hole in your application. If validate.php is called with a relative path, from a page loaded via HTTPS, then it will be using HTTPS by default -- relative paths inherit the protocol, hostname, and port if they aren't explicitly specified.
None of this means that your page, however, is secure. It means that the data that is being sent is being encrypted. You could still have several issues (weak passwords, SQL injection, cross-site scripting, etc.) that you need to deal with even when using HTTPS to transfer data. If you are using HTTPS, at least, your data transfers will be much more difficult to intercept or spoof.
使用相对路径就可以了。为了确保您可以使用网络数据包查看器应用程序来查看内容是否已加密。然而，关于您的代码，我担心一件事，您是否将经过验证的数据存储在会话变量中？如果是这样，您确定除了 root 用户和 php.ini 之外没有人可以访问会话值吗？我建议在数据库中存储经过验证的值，以防万一，您始终可以使用 crontab 删除过时的记录。
It is OK to use relative paths. To be sure you can use network packet viewer application to see if the contents are encrypted. However one thing concerns me about your code, do you store validated data in session variables? If so, are you sure no one can access session values other than root user and php. I would recommend storing validated values within database just in case, you can always remove outdated records using a crontab.