1

If jquery's ajax call does not use https in that case, how do we use https with the ajax call?

My question is different than the other one referenced. I am specifically asking if the page is already https and does an ajax post, does the url provided to the ajax call need to include https, or will the post already be https. The other question referenced does not answer this. Or it is not clear from that question.

Brett Drake
  • 301
  • 3
  • 12
  • 2
    Possible duplicate of [How to Make an AJAX HTTPS GET Request Using jQuery](http://stackoverflow.com/questions/21056990/how-to-make-an-ajax-https-get-request-using-jquery) – Phiter Mar 22 '16 at 17:16

1 Answers1

0

If the current page do not use https, you need to explicitly specify 'https://' in the url you give to jQuery.

WARNING: If the current page do not use https, even if you explicitly specify https for the ajax call, a malicious person on the network CAN change to current webpage to force your page to make an unsecure http call. (see sslstrip)

The ONLY secure way to make an https AJAX call in a secure way is FROM an https webpage

Tom
  • 4,666
  • 2
  • 29
  • 48
  • so if your current page is https and you make an ajax post call from that page, does the url given to ajax have to specify https in order for it to be https? – Brett Drake Mar 23 '16 at 14:00
  • if you make a call from an https page it will be https EXCEPT if you explicitly specify http in the url of the ajax call – Tom Mar 23 '16 at 14:20