When are POST variables sent in an HTTPS request? 2

[Maccaday]

Hi,

I was wondering when precisely POST/PUT variables are sent in an HTTPS request. The questions pertain to requesting page transmitted over HTTPS from a page that was transmitted over HTTP. I have two questions:

1) Are POST/PUT variables sent at the same time as the initial request to the server (therefore they wouldn't be secure if sent from a non-secure page), or after the secure 'handshake' process has been completed (therefore making them secure to send directly from a page that isn't itself secure)?

2) If a secure connection has already been established, and there are cached session keys, is the scenario the same or is it different (e.g. if in the first question the post variables weren't secure, but once the session keys had been established, subsequent POST/PUT variables to the same address would be secure even from a non-secure page)?

Thanks in advance for your responses.

 

[sleipnir214]

On an HTTPS connection, all handshaking necessary for establishing the secure connection happens before any HTTP headers are transmitted. This is why secure sites can't share IP addresses the way non-secure sites can -- the web server must make a decision as to which secure certificate to use on the connection before it ever receives the "Host:" HTTP/1.1 header.


How was the session key stored on the client? If it was stored in a cookie, then that cookie can be configured so that it requires a secure connection to be transmitted back to the server. (See

http://wp.netscape.com/newsref/std/cookie_spec.html)

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Maccaday]

Thanks, that was just the response I was hoping for.