Request to a json resource from an http page to an https server

Question

Can a jsonp request from a user on an http page (made by the browser) to an https server be considered secure?

For example:

The user is on:

http://www.example.net

On that page there's a form that, on submit, is sends a jsonp request to:

https://secureapi.net

Can the information on the submit form be read as if the api server is on http?

I believe you can only do this if you are making the request on the same domain. Otherwise, it wont work. — bsimic
– bsimic, Commented Feb 17, 2012 at 16:56
@bsimic — Getting around the same origin policy is the point of JSONP. — Quentin
– Quentin, Commented Feb 17, 2012 at 17:00
@bsimic — SSL and the Same Origin Policy are defences against completely different types of attack. Nothing about SSL would prevent JSONP from working. — Quentin
– Quentin, Commented Feb 17, 2012 at 22:56
@Quentin is right graph.facebook.com/cocacola can be accessed from an http page. — Osvaldo
– Osvaldo, Commented Feb 18, 2012 at 8:45

Quentin · Accepted Answer · 2012-02-17 16:59:37Z

No. While the data can't be sniffed in-flight, the HTTP page triggering the request is vulnerable to alteration by man-in-the-middle attacks. JS could be injected which can then leak the data retrieved via HTTPS.

Vivek · Accepted Answer · 2012-02-17 16:58:05Z

0

ys it is secure provided U send encrypted data to other page and decrypt the info on another page

answered Feb 17, 2012 at 16:58

Vivek

6411 gold badge12 silver badges24 bronze badges

1 Comment

Quentin Over a year ago

I've having trouble understanding that sentence, but I'm pretty certain that its incorrect.

Collectives™ on Stack Overflow

Request to a json resource from an http page to an https server

2 Answers 2

Comments

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Linked

Related