从 HTTP 到 HTTPS 的 POST 安全吗？
我有一个带有表单的 HTTP 页面。如果我将操作设置为 HTTPS 页面，请求是否安全？浏览器在将数据发送到网络之前是否处理了所有数据？或者我应该对整个网站使用 HTTPS？
I have a HTTP page with a form. If I set the action to a HTTPS page, is the request secure? Does the browser process all the data before it sends it to the net? Or should I use HTTPS for my entire site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
是的，如果您的表单发布到的位置是 HTTPS，那么它将是安全的。
然而，用户可能会感到惊讶，因为他们的浏览器中的表单页面上没有锁定图标。从可用性的角度来看，让两个页面都是 HTTPS 可能会更好。
Yes, it'll be secure if the location your form is posting to is HTTPS.
Users, however, may freak out that there's no lock icon in their browser on the page with the form. You may be better off from a usability standpoint having both pages be HTTPS.
Troy Hunt 发现了一个简单的 中间人攻击表明从 HTTP 到 HTTPS 的发布绝不是安全的。随着免费 WiFi 的普及，这种攻击将变得非常容易执行。
http://www.troyhunt .com/2013/05/your-login-form-posts-to-https-but-you.html
No. Troy Hunt identifies a simple man-in-the-middle attack that shows that posting from HTTP to HTTPS is by no means secure. With the proliferation of free WiFi this attack would be very simple to execute.
http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html
是的。只要需要安全的请求是 https，就可以了。
话虽这么说，包括 gmail 在内的许多关键网站已经不再费心将其网站的一小部分划分为 https，而是将整个网站设为 https。它更容易、更安全，而且性能损失很小。
Yes. As long as the request that needs to be secure is https, you're good.
That being said, many key sites, including gmail, have stopped bothering carving off small sections of their site to be https and just made their whole site https. It's easier and safer, and you lose little in the way of performance.
不要这样做！
考虑 MITM 攻击，攻击者坐在服务器和客户端之间的线路上，在登录表单到达客户端之前修改登录表单。登录表单现在包含键盘记录器或将 POST 操作指向网络钓鱼页面而不是真实服务器。最终用户不会收到任何警告或 UI 提示，因此他们会继续提交表单。
考虑一下 MITM 攻击，攻击者在咖啡店部署“免费 Wifi”（通过智能手机热点或其他方式）。当毫无戒心的人使用这个“免费 Wifi”以 HTTP 表单登录时，即使它执行了 HTTPS 的 POST，攻击者也可以通过分析用户的热点网络流量来查看用户的明文凭据。
参考资料：
Dont do it!
Consider a MITM attack where an attacker sitting on the wire somewhere between the server and client modifies the login form before it reaches the client. The login form now includes a keylogger or points the POST action to a phishing page instead of the authentic server. There is no warning or UI cue for the end-user, so they go ahead and submit the form.
Consider a MITM attack that involves the attacker deploying a "free Wifi" at a coffee shop (via a smartphone hotspot or whatever). When unsuspecting people use this "free Wifi" to login with an HTTP form, even though it does a POST to HTTPS, the attacker can see the user's plaintext credentials by analyzing their hotspot network traffic.
References:
通过 HTTPS 发布时，从表单到服务器的实际数据传输是加密的。如果这就是您所说的安全的意思，那么是的，它是安全的。
我认为您的问题要表达的是，客户端在发布之前阅读表单的情况如何。无论是否使用 HTTPS，这当然是可能的。
但另一方面，您可能应该对实际表单使用 HTTPS。当用户的帖子通过 HTTP/HTTPS 边界重定向时，某些浏览器会警告用户。另外，我认为您的用户不会乐意填写没有显示安全图标的表单。
The actual data transfer from your form to the server is encrypted when posting over HTTPS. If that is what you mean by secure, then yes, it is secure.
I think what you are getting at in your question is, what about client-side stuff reading the form prior to post. That is certainly possible, HTTPS or not.
On another note though, you should probably use HTTPS for the actual form. Some browsers warn users as their posts are redirected over the HTTP/HTTPS boundary. Plus, I don't think your users will be happy filling out a form where there is no secure icon showing.
如果您将操作设置为 HTTPS，这确实是安全的。在通过 HTTPS 发生任何事情之前，必须先进行握手，并且发送数据的浏览器必须在操作发生时执行此操作。
If you set action to HTTPS this will indeed be secure. Before anything can happen over HTTPS a handshake has to occur, and the browser sending the data will have to do this when the action occurs.