ASP.NET MVC：返回对不安全页面上提交的 https 表单的不安全响应
我在不安全的 (http) 页面中有一个安全表单（属性操作 =“https://...”）。目的是安全地传输数据，同时避免由于我的页面上不安全的 Google 地图元素而出现混合内容警告（“某些项目不安全”）。
当表单发布并成功时，一切都很好。但是，如果表单失败，我的用户最终会进入同一页面，但现在整个事情都受到保护（并生成混合内容警告）。
如何接受表单的安全输入，并且在表单提交失败时仍发回相同的不安全页面？
I have a secure form (attribute action="https://...") in an unsecured (http) page. The purpose is to transmit data securely while avoiding mixed content warnings ("some items are unsecured") due to unsecured Google Maps element on my page.
When the form posts and succeeds, everything is fine. However, if the form fails, my user ends up on the same page but now the whole thing is secured (and generates mixed content warnings).
How can I accept secure input from a form, and still send back the same unsecured page if the form submission fails?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在 HTTP 页面中呈现表单，即使表单指向 HTTPS URL，也违背了 SSL 的目的。如果您的表单指向 HTTPS，则只能通过 HTTPS 提供服务。同样，如果通过 HTTP 提供服务，则它应该仅指向 HTTP。请参阅此博客了解更多信息。
此外，这些“混合内容警告”错误试图防止进一步滥用 SSL，因为您正在通过未加密的通道访问不受您控制的资源。一旦 SSL 以这种方式被破解，攻击者就有可能将自己的 Javascript 注入到响应中，那么您的页面经过 SSL 加密的事实就毫无用处了。
简而言之，验证使用 SSL 是否是您的应用程序的严格要求，如果不是，请将其删除。您今天的应用程序配置的安全性相当于通过 HTTP 提供所有服务。如果这是不可接受的，请划分您的网站，使引用 Google 地图的网站部分与处理安全交易的网站部分不同。
Having a form rendered in an HTTP page, even if the form is pointing to an HTTPS URL, defeats the purpose of SSL. If your form points to HTTPS, it should only be served via HTTPS. Similarly, if it is served via HTTP, it should only point to HTTP. See this blog for more information.
Additionally, these "mixed content warning" errors are trying to prevent an additional misuse of SSL in that you are accessing resources not under your control and via an unencrypted channel. Once the SSL is broken out of in this manner, it's possible for an attacker to inject his own Javascript into the response, then the fact that your page was SSL-encrypted is useless.
In short, verify that using SSL is a firm requirement for your application, and remove it if it's not. Your application configuration today is the security equivalent of serving everything via HTTP. If this is unacceptable, divide your site such that the portion of your site which references Google Maps isn't the same portion of your site which handles secured transactions.