Secure webform inside non-secure page

Question

My Drupal 7 site uses both Webform and Secure Pages modules. I've created webform which is available as a block inserted to the bottom of another Drupal node. This node should be accessible using http protocol, but the submission of the form should be encrypted using https.

There is an option in the Secure pages (called "Secure forms") for entering form ID's, which should have https flag set to true. So I've enetered the form ID ("webform_client_form_183") here and the result is, that the module generates correct form action (). But, when I submit the form (from let's say URL http://mysite.com/thepage), the form content isn't saved to the database and URL https://mysite.com/thepage is loaded to the browser instead. The form here is filled in with the data I've entered in previous step and submitting the form from https://mysite.com/thepage does finally the right thing and data are stored in the database.

What I should do to correctly submit (using https) the form from page located at http://... URL?

Answer 1

You shouldn't really try. If form is served via HTTP, attacker already stolen your user's data using MiM attack to inject his own JS code into your site, so sending it via HTTPS is pointless at this moment.

If you need reliable security, always serve form using encryption. If you don't, don't waste resources on unneeded SSL processing.

See Transport Layer Protection Cheat Sheet for more details, as Clive suggested.