0

I have a PHP page on my SSL server which acts as a REST API effectively. What I need to do is take the unencrypted password from a different domain and POST to my page. After this, the server returns the encrypted data in JSON. I do this with my current website as a POST from the same domain is completely secure but I am not sure about from a different domain? Is there any way a hacker can intercept the POST data before it is encrypted?

Thanks

Kabeer

kabeersvohra
  • 1,049
  • 1
  • 14
  • 31

3 Answers3

2

I didn't comprehend what you're describing in your question, but as for your title:

Is posting unencrypted passwords to an HTTPS server unsafe?

No, it is completely safe. Millions of websites do this every day via their login forms.

Jonathon Reinhart
  • 132,704
  • 33
  • 254
  • 328
1

If you are receiving the POST data via HTTPS, then it is encrypted in transit and not easily intercepted. It is encrypted using a shared symmetric key between the client and the server, so that only they can decrypt each other's messages.

See How exactly HTTPS (ssl) works

Leonardo Gonzalez
  • 1,179
  • 9
  • 9
1

I wouldn't say it is safe, but I would agree that it is fairly common to pass unencrypted user/pass and only depend on TLS/SSL... TLS/SSL has been compromised a few times over the last couple of years, so depending entirely on it can involve risk.

Joshua Sprague
  • 121
  • 3