安全的跨域表单提交
我有一位客户希望继续通过第三方供应商托管他们的表单，但要求我重新设计他们的网站。不幸的是，目前表单托管在第 3 方服务器上的 iframe 中，或者只是到第 3 方的直接链接。
这些形式很丑陋，制作也很差劲，但它就是这样。我必须使用它们来处理数据。
然而，如果我能自己制作表单，让它们看起来像网站的其他部分，并且工作得很好，我会很高兴。
棘手的一点：表单信息必须是安全的。没有财务数据，但可以提交简历，并且可能还可以提交一些病史。
因此，如果我创建一个表单并将其托管在具有 SSL 证书的服务器上，并将其发布到第 3 方的安全服务器 - 数据安全吗？
如果没有，我必须采取哪些选项（如果有）才能实现将数据安全地发布到服务器的漂亮表单的目标？第 3 方没有针对其表单的自定义选项。
谢谢。
I have a client who would like to continue to host their forms with a 3rd party vendor, but has asked me to redesign their site. Unfortunately, right now the forms are hosted in an iframe on the 3rd Party's servers, or just a direct link to the 3rd party.
The forms are ugly and poorly made, but it is what it is. I have to use them for handling the data.
However, I'd love it if I could make the forms myself, have them look like the rest of the site, and work nicely.
Tricky bit: The form information MUST be secure. No financial data, but resumes, and potentially some medical history could be submitted.
So if I create a form and host it on a server with an SSL certificate, and post it to the 3rd party's secured server - is the data secure?
If not, what options (if any)do I have to achieve my goal of a nice looking form that securely posts data to their server? The 3rd party has no customization options for their forms.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
本质上并不安全。主机上的 SSL 不相关，第三方服务器上的 SSL 相关。但是，您必须将帖子设置为“https://...”而不仅仅是“http://”，这不足以使其成为“安全服务器”，您必须安全地调用它。您还需要在主机上使用 SSL（即使知道它无关紧要），因为您希望您的页面在其 url 中显示为“https://”，以便为信息较少的用户创建安全感。
Not inherently secure. The SSL on the host is not relevant, the SSL on the third party server is. However you must set the post to "https://..." rather than just "http://", it isn't enough for it to be a "secure server" you have to invoke it securely. You will want to also USE the SSL on the Host (even knowing that it is irrelevant) because you want your page to show up with "https://" in it's url to create the perception of security to the less inform user.
是的，它是安全的。用户的表单将发布到 https://thirdpartyserver.com，这将确保加密发布。
Yes, it is secure. The user's form will post to https://thirdpartyserver.com, which will ensure an encrypted post.