# SSL before or after submit? **URL:** \ **Category:** Rails\ **Created:** [June 8, 2009, 2:02pm UTC](https://www.ruby-forum.com/t/ssl-before-or-after-submit/169769 "2009-06-08T14:02:50Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![paulbutcher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@paulbutcher](https://www.ruby-forum.com/u/paulbutcher)\ **Post date:** [June 8, 2009, 2:02pm UTC](https://www.ruby-forum.com/t/ssl-before-or-after-submit/169769/1 "2009-06-08T14:02:50Z")
A general question regarding SSL and login. Does it matter if a login form is not passed through SSL when sent to the user browser but the post action is? Will the password be sent through SSL in this case? ---
**Author:** ![paulbutcher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@paulbutcher](https://www.ruby-forum.com/u/paulbutcher)\ **Post date:** [June 8, 2009, 7:04pm UTC](https://www.ruby-forum.com/t/ssl-before-or-after-submit/169769/2 "2009-06-08T19:04:40Z")
2009/6/8 Pål Bergström [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > A general question regarding SSL and login. Does it matter if a login > form is not passed through SSL when sent to the user browser but the > post action is? Will the password be sent through SSL in this case? Both need to be wrapped in SSL for proper security. If the form is not SSL then people can do MITM attacks (among others) to get the username/password sent to the wrong server. – Aaron T. [http://synfin.net/](http://synfin.net/) [http://tcpreplay.synfin.net/](http://tcpreplay.synfin.net/) - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. – Benjamin Franklin ---
**Author:** ![paulbutcher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@paulbutcher](https://www.ruby-forum.com/u/paulbutcher)\ **Post date:** [June 8, 2009, 7:10pm UTC](https://www.ruby-forum.com/t/ssl-before-or-after-submit/169769/3 "2009-06-08T19:10:23Z")
Aaron T. wrote: > Both need to be wrapped in SSL for proper security. If the form is > not SSL then people can do MITM attacks (among others) to get the > username/password sent to the wrong server. Thanks for the clarification. 🙂 ---
**Author:** ![paulbutcher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@paulbutcher](https://www.ruby-forum.com/u/paulbutcher)\ **Post date:** [June 8, 2009, 8:20pm UTC](https://www.ruby-forum.com/t/ssl-before-or-after-submit/169769/4 "2009-06-08T20:20:46Z")
Aaron T. wrote: > 2009/6/8 P�l Bergstr�m [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > > > A general question regarding SSL and login. Does it matter if a login > > form is not passed through SSL when sent to the user browser but the > > post action is? Will the password be sent through SSL in this case? > > Both need to be wrapped in SSL for proper security. If the form is > not SSL then people can do MITM attacks (among others) to get the > username/password sent to the wrong server. Besides that, users expect to see the lock (and https) on the page with the login form. I’d be leery of any site that contained a username/password that was not contained within a secure page. Plus there’s no good reason not to secure the login form’s page. ---
**Author:** ![paulbutcher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a5b964/32.png) [@paulbutcher](https://www.ruby-forum.com/u/paulbutcher)\ **Post date:** [June 8, 2009, 9:08pm UTC](https://www.ruby-forum.com/t/ssl-before-or-after-submit/169769/5 "2009-06-08T21:08:34Z")
Robert W. wrote: > Aaron T. wrote: > Besides that, users expect to see the lock (and https) on the page with > the login form. I’d be leery of any site that contained a > username/password that was not contained within a secure page. Plus > there’s no good reason not to secure the login form’s page. A strong reason. I say the same. I hesitate if I don’t see the lock and https.