如果 HTTP 网页向 HTTPS url 发出 ajax 请求，那么该帖子安全吗？
如果我创建了一个 html/jquery 小部件，该小部件打算放置在第 3 方网站上（用户的技术知识极低，可能缺乏 SSL 证书），并使用 jquery 进行 AJAX 将小部件的信息发布到安全的地方url 所发布的信息是否会得到正确保护？
编辑：任何人都可以详细说明没有 SSL 证书的网站的同源政策/影响吗？
If I created an html/jquery widget that was meant to be placed on 3rd party websites (where users are expected to have extremely low technical knowledge and probably lacking an SSL certificate) and used jquery to AJAX Post the information of the widget to a secure url the information posted would be secured properly correct?
Edit: Can anyone elaborate on the same origin policy / implications of having a site that has no SSL certificate in regards to it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
数据在传输过程中是安全的，但发出请求的页面可能会在到达客户端之前被拦截和修改，因此请求可能会被转移或修改。 （简单情况 - 发出两个请求，而不是一个，一个请求到安全服务器，一个请求到黑客服务器）
如果您想要安全性，那么您需要让页面执行数据收集/提交，并让页面处理通过 SSL 传递的数据。
（您还必须处理同源策略的问题。）
The data would be secure in transit, but the page making the request could be intercepted and modified in before reaching the client so the request could be diverted or modified. (Simple case - make two requests instead of one, one to the secure server and one to a hacker's server)
If you want security then you need to have both the page performing data collection/submission and the page processing the data passed over SSL.
(You would also have to deal with the issue of Same Origin Policy.)
这取决于您想要使用的“安全”定义。安全性是主观的，有些人对“安全”的定义比其他人更“广泛”。
如果通过“安全”您询问嗅探器是否可以通过网络获取您的帖子，那么当然，使用 https 将使其在这方面更加安全。
但是，如果该页面向您的服务器执行此操作以执行用户可能不希望其执行的任何操作，那么根据我的定义，它是不安全的。
例如，如果您的服务向站点提供数据（换句话说，出于合法目的），那么我可以使用此脚本调用您的服务。一个很好的例子是调用您的网站来提供股票报价，或者页面上显示的当日笑话，这很好。
但是，如果您的脚本正在发帖来跟踪我在网站上的存在、将我添加到潜在的邮件列表、窃取我的数据或除我在您的网站上完成工作所需的任何其他目的，那么您就违反了我的隐私，或者至少在幕后做一些我真的不期望或不想发生的事情。在这种情况下，根据定义，任何使用秘密方式跟踪我或窃取我的个人和/或财务数据（包括我的浏览习惯）的活动都是安全违规。
另外，如果您的脚本以任何方式削弱了网页上的现有防御或引入了新的漏洞，那么不，根据任何人的定义，它都不安全。
That depends on the definition you want to use for "Secure". Security is subjective, and some people have a more "broad" definition of "secure" than others.
If by "Secure" you're asking if a sniffer can get your post across the network, then sure, using https would make it secure in that regards.
However, if the page is doing this post to your server to do anything that the user might not want it to do, then by MY definition it's not secure.
For example, I would be fine with this script calling your service if your service were providing data back to the site (for a legitimate purpose in other words). A good example would be calling your site to provide a stock quote, or a joke-of-the-day that shows up on the page, that's fine,.
BUT if your script was doing a post to track my presence on the site, add me to a potential mailing list, steal my data, or any purpose other than what's needed for me to do my work on your site, then you're violating my privacy, or at least doing something behind the scenes that I really don't anticipate or want to happen. In that case, by definition, any activity that uses stealth to track me or steal my personal and/or financial data (including my browsing habits) is a security violation.
Also, if your script in any way weakens existing defenses on teh web page or introduces new vulnerabilities, then no, it's not secure by anyone's definition.
是的，它将使用 HTTPS 进行 Ajax 请求。
但是，您无法发出异地请求（同源策略），并且当您的客户端缺少适当的 SSL 证书时，我不知道如何发出安全的 AJAX 请求（？）。
Yes, it will use HTTPS for the Ajax request.
However you cannot make an off-site request (same-origin policy), and when your client lacks a proper SSL certificate, I don't see how you would make a secure AJAX request (?).