4 ms·
This doesn't do any good because the page that contains the form can be transparently altered to post somewhere else by a man in the middle.
by kogir 17y ago
This doesn't do any good because the page that contains the form can be transparently altered to post somewhere else by a man in the middle.
- revetkn 17y agoSaying that it doesn't do any good might be a bit strong - it's still vulnerable, but much less so than straight-up POSTing over an unencrypted channel.
- tptacek 17y agoYou're right in the general case, but in the API case it doesn't matter how the form is rendered because API clients don't parse forms.