Download Netsparker
Pricing
Blog
Contact
Netsparker

Sensitive Input Fields (Password Field etc) in Forms Served Over Insecure HTTP

Netsparker detected that a critical form is served over HTTP.

Impact

If an attacker can carry out a man-in-the-middle attack, he/she may be able to intercept traffic by injecting JavaScript code into this page or changing action of the HTTP code to steal the user's password. Even though the target page is HTTPS, this does not protect the system against man-in-the-middle attacks.

This issue is important, as it negates the use of SSL as a privacy protection barrier.

Actions to Take

  1. See the remedy for solution.
  2. Move all of your critical forms to HTTPS and do not allow these pages to be served over HTTP.

Remedy

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input, starting from the login process, should only be served over HTTPS. 


Go back to the Complete list of Vulnerability Checks.