Question

If I have this page in “http://example.com/login” with GET verb:

<form action="https://example.com/login" method="post">
   <input type="text" name="login"/>
   <input type="password" name="pass"/>
   <input type="submit" value="Login"/>
</form>

Is it a security flaw? I mean, the page is HTTP but when sending the data it uses HTTPS. I have read several times that I should require HTTPS already in the login page, but I don’t clearly see why.

Answer 1

Yes, it’s flawed. What you have is secure as far as it goes, as long as it’s your login form the user is seeing.

Because your login form isn’t secured, I can come along and substitute my own spoof login form and collect your users’ login details, eg. via a man-in-the-middle attack. A login system is only secure if both the login form and the target page use SSL.

Also, it doesn’t look secure to the user. Users look for the padlock symbol on the login form, and yours doesn’t have one.