通过 HTTPS 发布 HTML 表单值
我有一个网站，目前正在使用 https 进行安全登录和交易。除非您登录，否则您无法导航到主站点。
我收到了一位合作伙伴的请求，他们询问是否可以从自己的 Web 应用程序无缝导航到我们的网站，而无需登录。该网站也使用 https。
我已经设置了一个“PartnerLoginPage.aspx”页面，并允许他们将 html 表单值发布到该页面中（他们有正确的用户登录详细信息）。然后，我根据发布的值对它们进行身份验证并将它们重定向到主站点。他们不需要登录，我已经对他们进行了身份验证，并且效果很好。
我最担心的是，这不是一种安全的用户身份验证方式。如果您将 html 表单值 POST 到 https 页面中，数据仍然是加密的吗？只是出于兴趣，如果他们的网站不是 http 网站（它是），数据仍然会加密吗？
例如他们的 HTTPS->表单后值 ->我们的 HTTPS ->表单后值数据是否已加密？
和
他们的 HTTP（注意：没有“s”）-> 表单后值 ->我们的 HTTPS ->表单后值是否已加密？
感谢您的帮助，
斯图尔特
I have a website that is currently using https for secure login and transactions. You can't navigate to the to the main site unless you login.
I have had a request from a partner who have asked if they can seamlessly navigate to our site from their own web application, without logging in. There site is also using https.
I've set up a "PartnerLoginPage.aspx" page, and allowed them to POST html form values into this page (they have the correct user login details). I then authenticate them based on the posted values and redirect them to the main site. They don't need to login then, I've already authenticated them and it works perfectly.
My biggest concern is that this is not a secure way of authenticating the user. If you POST html form values into a https page is the data still encrypted? Just out of interest, if their site was not an http site (it is) would the data still be encrypted?
eg THEIR HTTPS-> FORM POST VALUES -> OUR HTTPS -> ARE FORM POST VALUES DATA ENCRYTPED?
and
THEIR HTTP (note: no 's') ->FORM POST VALUES -> OUR HTTPS -> ARE FORM POST VALUES ENCRTYPED?
Thanks for any help,
Stuart
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当然，假设所有密钥都是有效的...
如果请求是通过 https 页面发出的，则该请求将被加密（这意味着通过请求发送的 POST 值将被加密，无论目的地如何）。
如果请求是从非 https 页面发送到 https 页面，则请求不会加密，但响应会加密，因此 post 变量不会加密（但返回的值会加密）。
HTTPS 本质上设置正在通信的服务器/页面是否使用加密，因此 http -> https = 未加密请求，加密响应，https -> http = 加密请求，非加密响应。
当然，可以在脚本级别设置安全级别，但我认为您的答案并不担心这一点。
快速帖子脚本
为什么不为合作伙伴网站提供一个服务帐户，例如“用户名：partners，pw：sheswithme”或类似的帐户？您可以使用 cURL 设置 cookie 并传递服务器变量，让它们将表单指向发出请求的脚本，而不是让用户半直接访问您的脚本。
Assuming all keys are valid, of course...
If the request is made an https page, then the request is encrypted (meaning the POST values, which are sent via the request, are encrypted, regardless of destination).
If the request is made from a non https page to an https page, the request is not encrypted, but the response would be, so the post variables are NOT encrypted (but the value returned would be).
HTTPS essentially sets up whether the server/page that is talking is using encryption or not, so http -> https = non-encrypted request, encrypted response, https -> http = encrypted-request, non-encrypted response.
Of course, there are levels of security that can be set at the script level, but I don't think your answer is worried about that.
Quick Post Script
Why don't you give the partner sites a service account like "username :partners, pw: sheswithme" or some such? You could use cURL to set up the cookie and pass the server variables and have them point their form to a script that makes the request instead of having their users having semi-direct access to your script.