Https form

[manelandrce]

I would like to transfer data within my site using HTTPS forms.

I have a link to a https page (within my site), and in this https page I have a form with information like credit card, etc, etc and when I submit this form, I process this data in the same page (post back) but I receive a security alert message from IE, something like that: the data will be sent to a site not secure.

In the source code of the https page the form action is action="my_script.aspx?param=....", I suppouse that the form action should be action="

https://www.mysite.com/my_script.aspx?param=...."

Any Idea?

 

[adamroof]

no, do not use action=https, dont use action= at all, that is old asp. if you are using aspx pages that is.

<form runat="server"> is all you need. The action is determined by your control that is acted on, like an <asp:Button />

1. Are you using inline script or a code-behind file?
2. Are all your images relative paths?
<img src=image.gif NOT <img src=

http://blabla/image.gif

3. Are you using any external Javascript with a src= to an http address?
4. Is your code redirecting them after processing to a non-secure site?

 

[manelandrce]

1- I´m using code-behind
2- Image with relative paths
3- No external js
4- After process the secure info I redirect the page to a non-secure page.

Then you suggest to process the secure information in the button onclick event no in the Page_Load function. Ok??

 

[adamroof]

the page will process just as a normal page would, its just that you have it in an ssl directory.

public void Page_Load()
{
   if (!IsPostBack)
   {
      //populate your first time data and get/set your vars
   }
}

public void processSecure(object sender, EventArgs e)
{
    //you have a button/linkbutton/imagebutton
    //that calls this by onclick="processSecure"
    //do your stuff
    //thanks for your business
    Response.Redirect("[URL unfurl="true"]http://domain.com");[/URL]
    //have to use absolute path to kick em out of https
}

 

[adamroof]

and yes, not in the page_load, you want the user on the SSL form when entering data too, not just processing it in ssl

 

[manelandrce]

thanks for your answers, adamroof