Unsecure form on https?
 

Recently, I have been trying to sign up online for a service that requires my credit card details. The URL starts https and appears secure but when I click to submit the form I see a warning pop-up about sending an unencrypted form over the Internet.

Is it possible to have an unsecure form on an https site?

How can I check if the form is secure before submitting it?

Re: Unsecure form on https?
 

Check the HTML, if the <form action="something"> is to http:// and not to https:// then it will be sending to an insecure page.

Re: Unsecure form on https?
 

The transmission and page may be secure, but the following page or parts of it may not be, as such the page is redirecting to non secure. Very bad form on a payment gateway, you should have all your images and code for the checkout on the secure server. Most of the secure payment gateways allow you to store a reasonable amount of information on thier servers to avoid these problems occurring.

Re: Unsecure form on https?
 

What clots!
I thought something was wrong - many thanks Richard.

Re: Unsecure form on https?
 

Don't use it if you're worried about it.
Phone em up instead, that's what I do.

Re: Unsecure form on https?
 

Was the page you were on secure? The post instruction is on that page.

When it has done the post it redirects to the confirm page

http://secure.vispaconnect.co.uk/broadband/y-step6.php

Which you can load independantly to see what was on it.

They should really put this page on their secure server that would stop the concern you have.

Many companies only have online card processing these days. All they do is type the information into the same web screen you would have!

Re: Unsecure form on https?
 

The different pages of the signup are as follows:

http://www.vispa.net/broadband-business-office500.php
http://www.vispa.net/popup-office500.html
https://secure.vispaconnect.co.uk/br...vice=office500
https://secure.vispaconnect.co.uk/broadband/y-step2.php
https://secure.vispaconnect.co.uk/broadband/y-step3.php
https://secure.vispaconnect.co.uk/broadband/y-step3.php

The last page contains the line:
<form method="POST" action="http://secure.vispaconnect.co.uk/broadband/y-step6.php">
which, I think, is what Opera baulked at.

Are you telling me that the form is sent securely?

Re: Unsecure form on https?
 

If you use IE (Internet Explorer) you will see a padlock icon down in the bottem right hand corner. That then means the page or site in this case is secure. i.e. Hotmail

Re: Unsecure form on https?
 

Indeed - the page that displays the form uses HTTPS but the action of the form uses HTTP. I strongly suspect that Richard is correct in post #2 that this means that the contents of the form will be submitted insecurely to the next page - but I'm not sure. Anyone know for certain?

Re: Unsecure form on https?
 

I'm pretty sure it is. The forms post command is separate to the action which occurs afterwards which is to open another web page (that is outside the secure pages).

Opera should be warning you, they put that page in the same location as the rest of the process, but I'm pretty sure the cc details are posted to the secure server securely.

Re: Unsecure form on https?
 

Yeah, thats what https also means but the actiion of the form is not secure the site it self is.

Re: Unsecure form on https?
 

The PHP script will process the form information and generate a "success" type page (or forward to another script that does). To this end, the PHP script should be HTTPS and not HTTP - it's receiving data that should be secured. I don't think that because the current page is HTTPS then the POST request via HTTP is also secure - you're moving from secure to insecure, hence the warning.

Re: Unsecure form on https?
 

I work a lot with HTTP stuff and I can tell you with 100% confidence that that form will send insecurely (unencrypted) to an insecure page.

Someone mentioned that even if you phone them that they will most likely type it into the same screen - well at least they would be liable if something went wrong.

Re: Unsecure form on https?
 

Just going on the FAQ's i've been reading recently... This points out the problems of the route they use.

This is curious, if the page they refered to was secure, but the post was HTTP, how do you know that without reviewing the code each time you purchase on line? Makes a mockery of the padlock.

http://www.netbanx.com/faq/published/bespoke.html#0

What sort of scripts can you call after the transaction?

We can call back any sort of script, so long as it is accessable via a fully qualified URL.

Therefore, it does not matter if the script is written in ASP, PERL, DHTML, PHP or Cold Fusion.


--------------------------------------------------------------------------------
Can I host the confirmation pages that are displayed immediately after the customer has entered his card details?

Yes, the bespoke integration allows you to do this. NetBanx will issue you with a specification document based upon the information supplied to us in the Integration Questionnaire, if you choose to make use of this facility.

There are 2 distinct ways of generating the confirmation pages:

1. The NetBanx server displays the page by calling your script in the background, and then displaying the result to the browser.
2. The Browser redirects to your script in the foreground via a self-submitting form, for your server to display the result.

Notes for method 1:

All images, style sheets and JavaScript will need to be referenced as relative paths on the NetBanx server, and we must host these files. NetBanx will supply the relative path for you to use in the specification document. If attempts are made to reference images on your own server, then the browser will display a dialogue box warning that the page contains nonsecure items.
Hyperlink references to URLS on your server must be absolute, using the full http:// path, otherwise the browser will attempt to link to documents on our server.

Notes for method 2:

If you have a nonsecure server, then the browser will display a dialogue box warning that the customer is about to leave a secure connection. This may be offputting to the customer, as they have not yet had confirmation that their card has been dealt with.

Note that with both methods, due to the nature of the internet, you should be aware of the possibility that your server may be unreachable by either the browser or the NetBanx server. This would result in your server not registering the purchase, and the correct page not being served to the browser. Contingencies should therefore be considered, such as NetBanx hosting the confirmation pages instead.

Re: Unsecure form on https?
 

It's the fact folks keep referring to "secure and insecure pages", of which there are no such thing, that's confusing matters. The request for the page and the reponse from the server to that request are secure, not the page. The little lock symbol says "this page got here over a secure connection" not "this page is secure".

Re: Unsecure form on https?
 

Well true, but it makes it easier to explain. :p:

Re: Unsecure form on https?
 

But is that POST command being sent back over the secure connection, then the next page loaded insecurly, are both on an insecure connection?

Re: Unsecure form on https?
 

Does it though? Once terminology starts drifting, understanding tends to do likewise :)

Re: Unsecure form on https?
 

No, because it's the same as clicking a link like http://www.google.co.uk/ from a page displayed over SSL - it doesn't make Google be transmitted securely.

Re: Unsecure form on https?
 

No - the current page, with the lock symbol and the HTTPS URL, got to the browser securely. The request and response (which sent back the page) were over a secure connection. Once the browser receives the response, the connection ends. When the form is submitted, that's a POST request over a HTTP connection, to which there will be a response, also over a HTTP connection, which will be the confirmation page.

Re: Unsecure form on https?
 

This query all came about because I was trying to set up a client with a new ISP. I selected Vispa because they are recommended on ispreview, they offer a business service that matches our requirements at a reasonable price and they are local.

First they couldn't provide a printed contract for my client to sign. Instead I had to register for them using the Vispa web site. Then I discover that payment has to be made through a credit card. My client does not have a business credit card. Eventually I am told that I can request the forms to set up a direct debit but I must have an account first. I can only create this through their web site using a credit card. My solution was to bill it to my personal card and then invoice my client until the direct debit was effective. That's how I found myself at the problem I described at the beginning of this thread. The saga continues thus:
Well they can't say I didn't try!

Re: Unsecure form on https?
 

I like the bit "I will refer this to a developer" :D Meaning that until you told him otherwise he was ignorant to the fact that his company had put 40,000 people at risk of having their credit card details intercepted :D

Re: Unsecure form on https?
 

Hope you've posted this up on isp preview, so some of the next few thousand customers can see what their customer service can be like.

Re: Unsecure form on https?
 

Good idea. :tu: