0

My Drupal 7 site uses both Webform and Secure Pages modules. I've created webform which is available as a block inserted to the bottom of another Drupal node. This node should be accessible using http protocol, but the submission of the form should be encrypted using https.

There is an option in the Secure pages (called "Secure forms") for entering form ID's, which should have https flag set to true. So I've enetered the form ID ("webform_client_form_183") here and the result is, that the module generates correct form action (). But, when I submit the form (from let's say URL http://mysite.com/thepage), the form content isn't saved to the database and URL https://mysite.com/thepage is loaded to the browser instead. The form here is filled in with the data I've entered in previous step and submitting the form from https://mysite.com/thepage does finally the right thing and data are stored in the database.

What I should do to correctly submit (using https) the form from page located at http://... URL?

| improve this question | | | | |
  • 1
    Don't do this. It's insecure. See the Transport Layer Protection Cheat Sheet, Rule - Use TLS for All Login Pages and All Authenticated Pages section. – Clive Jan 28 '14 at 13:25
  • Anyway, good you asked, JardaC. You have a chance to avoid one big mistake :) – Mołot Jan 28 '14 at 13:32
1

You shouldn't really try. If form is served via HTTP, attacker already stolen your user's data using MiM attack to inject his own JS code into your site, so sending it via HTTPS is pointless at this moment.

If you need reliable security, always serve form using encryption. If you don't, don't waste resources on unneeded SSL processing.

See Transport Layer Protection Cheat Sheet for more details, as Clive suggested.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.