Unsecure form on https?

altis · 12-07-2004, 14:55

Recently, I have been trying to sign up online for a service that requires my credit card details. The URL starts https and appears secure but when I click to submit the form I see a warning pop-up about sending an unencrypted form over the Internet.

Is it possible to have an unsecure form on an https site?

How can I check if the form is secure before submitting it?

Richard M · 12-07-2004, 14:58

Check the HTML, if the <form action="something"> is to http:// and not to https:// then it will be sending to an insecure page.

SMHarman · 12-07-2004, 15:03

The transmission and page may be secure, but the following page or parts of it may not be, as such the page is redirecting to non secure. Very bad form on a payment gateway, you should have all your images and code for the checkout on the secure server. Most of the secure payment gateways allow you to store a reasonable amount of information on thier servers to avoid these problems occurring.

altis · 12-07-2004, 15:05

Quote:

Originally Posted by Richard M

Check the HTML, if the <form action="something"> is to http:// and not to https:// then it will be sending to an insecure page.

What clots!

Quote:

I thought something was wrong - many thanks Richard.

Richard M · 12-07-2004, 15:09

Don't use it if you're worried about it.
Phone em up instead, that's what I do.

SMHarman · 12-07-2004, 15:34

Was the page you were on secure? The post instruction is on that page.

When it has done the post it redirects to the confirm page

http://secure.vispaconnect.co.uk/broadband/y-step6.php

Which you can load independantly to see what was on it.

They should really put this page on their secure server that would stop the concern you have.

Quote:

Originally Posted by Richard M

Don't use it if you're worried about it.
Phone em up instead, that's what I do.

Many companies only have online card processing these days. All they do is type the information into the same web screen you would have!

altis · 12-07-2004, 15:56

The different pages of the signup are as follows:

http://www.vispa.net/broadband-business-office500.php
http://www.vispa.net/popup-office500.html
https://secure.vispaconnect.co.uk/br...vice=office500
https://secure.vispaconnect.co.uk/broadband/y-step2.php
https://secure.vispaconnect.co.uk/broadband/y-step3.php
https://secure.vispaconnect.co.uk/broadband/y-step3.php

The last page contains the line:
<form method="POST" action="http://secure.vispaconnect.co.uk/broadband/y-step6.php">
which, I think, is what Opera baulked at.

Are you telling me that the form is sent securely?

MadGamer · 12-07-2004, 16:10

Quote:

Originally Posted by altis

The different pages of the signup are as follows:

http://www.vispa.net/broadband-business-office500.php
http://www.vispa.net/popup-office500.html
https://secure.vispaconnect.co.uk/br...vice=office500
https://secure.vispaconnect.co.uk/broadband/y-step2.php
https://secure.vispaconnect.co.uk/broadband/y-step3.php
https://secure.vispaconnect.co.uk/broadband/y-step3.php

The last page contains the line:
<form method="POST" action="http://secure.vispaconnect.co.uk/broadband/y-step6.php">
which, I think, is what Opera baulked at.

Are you telling me that the form is sent securely?

If you use IE (Internet Explorer) you will see a padlock icon down in the bottem right hand corner. That then means the page or site in this case is secure. i.e. Hotmail

altis · 12-07-2004, 16:23

Quote:

Originally Posted by WNA

If you use IE (Internet Explorer) you will see a padlock icon down in the bottem right hand corner. That then means the page or site in this case is secure. i.e. Hotmail

Indeed - the page that displays the form uses HTTPS but the action of the form uses HTTP. I strongly suspect that Richard is correct in post #2 that this means that the contents of the form will be submitted insecurely to the next page - but I'm not sure. Anyone know for certain?

SMHarman · 12-07-2004, 16:27

Quote:

Originally Posted by altis

<snip>

The last page contains the line:
<form method="POST" action="http://secure.vispaconnect.co.uk/broadband/y-step6.php">
which, I think, is what Opera baulked at.

Are you telling me that the form is sent securely?

I'm pretty sure it is. The forms post command is separate to the action which occurs afterwards which is to open another web page (that is outside the secure pages).

Opera should be warning you, they put that page in the same location as the rest of the process, but I'm pretty sure the cc details are posted to the secure server securely.

**Damien** · 12-07-2004, 16:29

Quote:

Originally Posted by WNA

If you use IE (Internet Explorer) you will see a padlock icon down in the bottem right hand corner. That then means the page or site in this case is secure. i.e. Hotmail

Yeah, thats what https also means but the actiion of the form is not secure the site it self is.

greencreeper · 12-07-2004, 16:31

Quote:

Originally Posted by SMHarman

Was the page you were on secure? The post instruction is on that page.

When it has done the post it redirects to the confirm page

http://secure.vispaconnect.co.uk/broadband/y-step6.php

Which you can load independantly to see what was on it.

They should really put this page on their secure server that would stop the concern you have.

The PHP script will process the form information and generate a "success" type page (or forward to another script that does). To this end, the PHP script should be HTTPS and not HTTP - it's receiving data that should be secured. I don't think that because the current page is HTTPS then the POST request via HTTP is also secure - you're moving from secure to insecure, hence the warning.

Richard M · 12-07-2004, 16:42

Quote:

Originally Posted by altis

Indeed - the page that displays the form uses HTTPS but the action of the form uses HTTP. I strongly suspect that Richard is correct in post #2 that this means that the contents of the form will be submitted insecurely to the next page - but I'm not sure. Anyone know for certain?

I work a lot with HTTP stuff and I can tell you with 100% confidence that that form will send insecurely (unencrypted) to an insecure page.

Someone mentioned that even if you phone them that they will most likely type it into the same screen - well at least they would be liable if something went wrong.

SMHarman · 12-07-2004, 16:46

Quote:

Originally Posted by Richard M

I work a lot with HTTP stuff and I can tell you with 100% confidence that that form will send insecurely (unencrypted) to an insecure page.

Someone mentioned that even if you phone them that they will most likely type it into the same screen - well at least they would be liable if something went wrong.

Just going on the FAQ's i've been reading recently... This points out the problems of the route they use.

This is curious, if the page they refered to was secure, but the post was HTTP, how do you know that without reviewing the code each time you purchase on line? Makes a mockery of the padlock.

http://www.netbanx.com/faq/published/bespoke.html#0

What sort of scripts can you call after the transaction?

We can call back any sort of script, so long as it is accessable via a fully qualified URL.

Therefore, it does not matter if the script is written in ASP, PERL, DHTML, PHP or Cold Fusion.

--------------------------------------------------------------------------------
Can I host the confirmation pages that are displayed immediately after the customer has entered his card details?

Yes, the bespoke integration allows you to do this. NetBanx will issue you with a specification document based upon the information supplied to us in the Integration Questionnaire, if you choose to make use of this facility.

There are 2 distinct ways of generating the confirmation pages:

1. The NetBanx server displays the page by calling your script in the background, and then displaying the result to the browser.
2. The Browser redirects to your script in the foreground via a self-submitting form, for your server to display the result.

Notes for method 1:

All images, style sheets and JavaScript will need to be referenced as relative paths on the NetBanx server, and we must host these files. NetBanx will supply the relative path for you to use in the specification document. If attempts are made to reference images on your own server, then the browser will display a dialogue box warning that the page contains nonsecure items.
Hyperlink references to URLS on your server must be absolute, using the full http:// path, otherwise the browser will attempt to link to documents on our server.

Notes for method 2:

If you have a nonsecure server, then the browser will display a dialogue box warning that the customer is about to leave a secure connection. This may be offputting to the customer, as they have not yet had confirmation that their card has been dealt with.

Note that with both methods, due to the nature of the internet, you should be aware of the possibility that your server may be unreachable by either the browser or the NetBanx server. This would result in your server not registering the purchase, and the correct page not being served to the browser. Contingencies should therefore be considered, such as NetBanx hosting the confirmation pages instead.

greencreeper · 12-07-2004, 16:49

It's the fact folks keep referring to "secure and insecure pages", of which there are no such thing, that's confusing matters. The request for the page and the reponse from the server to that request are secure, not the page. The little lock symbol says "this page got here over a secure connection" not "this page is secure".