Can you force an HTML form to use HTTPS for relati

2020-07-14 09:54发布

问题:

I have a website in which every page is served via HTTPS. On one of the pages I have a form whose action attribute is set to a relative URL.

The page with the form can only be accessed via HTTPS and the page the form posts to can only be hit via HTTPS, yet in IE I get a security warning telling me I'm about to switch to an insecure connection. Is there any way to prevent this problem beyond codding the full URL including the protocol into the form's action attribute?

Update:

I tried hardcoding the entire URL and still I get the pop-up.

The relevant code is:

<html>
    <body>
      <form action="https://mydomain.com/editProfile">
         ...
      </form>
    </body>
</html>

As soon as I click the submit button in IE6 I get a security alert pop-up. If I click ok, the result page is displayed and the protocol is still HTTPS. I'm starting to wonder if it is the form POST that's causing the issue.

回答1:

You can't (other than setting the base URL to https). According to RFC 1808 (relative URLs), an URL starting with a scheme name is always interpreted as an absolute URL (section 4, step 2a).

(As others pointed out, relative URLs keep the scheme, so the problem was elsewhere, probably with an unencrypted image or CSS file, but the question was interesting in its own right.)



回答2:

Internet explorer is notorious for demanding that there are NO http requests in your https page or the security popup pops up.

Are all your links in the page relative?

Are there no hidden redirects in your webserver?

Think about pictures/css files/javascript files, can they all be retrieved using https?