4 ms·

Login is POSTed to a SSL endpoint at which point cookies are set that are SSL only. Passwords are never sent over a non-SSL request.

• lamby 16y ago
  Thanks. Although without HTTP STS or similar I could still MITM the landing page.. :)
  • abraham 16y ago
    Very true! I hadn't even thought of that.