4 ms·
If the form itself was delivered over http then it doesn't matter. An attacker could easily change the POST address to something else. And how could you even te
by __david__ 12y ago
If the form itself was delivered over http then it doesn't matter. An attacker could easily change the POST address to something else. And how could you even tell? Browsers don't display the URL that a submit button is going to POST to...
- kansface 12y agoThis is true. You'd have to look for a script tag with src of https://checkout.stripe.com/checkout.js https://checkout.stripe.com/checkout.js. Alternatively, you could try to follow the onclick handler for the button (Event Listeners in Chrome).
- dasil003 12y agoOf course if an attacker can MitM any HTTP web page on a site (ie. if a site is not all SSL) then it really doesn't matter if they serve the form over HTTPS because the attacker can set up another form over HTTP and the victim will be none the wiser. And then there's the possibility of XSS in which case neither lack of MitM access or use of HTTPS will be sufficient protection.