Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #35341

Re: Submitting *encrypted* forms via AJAX

From jecxjo <jeff@sh0.xyz>
Newsgroups comp.lang.javascript
Subject Re: Submitting *encrypted* forms via AJAX
Date 2018-07-02 03:21 +0000
Organization A noiseless patient Spider
Message-ID <phc5o8$61d$1@dont-email.me> (permalink)
References <075dc3b9-1b96-4bc9-9d88-a79ee815e8e2@googlegroups.com>

Show all headers | View raw

On 6/25/18 4:48 AM, bit-naughty@hotmail.com wrote:
>Hi,
>I have a Login box on my website, with a name and password field. When it's submitted, I want it to happen without a refresh (ie. the authentication), and I also want the form data to be ENCRYPTED between client and server (because of the password).
>
>Number 1) How do I submit? How do I get the form data into a format that "request.send" in the AJAX call will take? Do I have to extract the form data myself with "document.forms" and muck about with it somehow?
>and 2) How do I encrypt? Is putting a "https" in the "request.open("POST", https<blah blah>);" enough, or do I have to do something else?
>
>Thanks muchly for your help.


Not sure why the other responses went so off topic and into arguments...

It's generally assumed that if you are looking to perform secure
 communications you would use HTTPS. Standards groups pick the best
 algorithms for the job, browsers use and test commonly used ssl/tls
 libraries so you can trust the implementation of secure communications as
 much as one can.

As for the for the commonly repeated quote "you can't do encryption in
 Javascript" the issue is about authenticating the source of a message. When
 using HTTPS the server to browser communication path is secured well before
 any JS code is executed. If a MITM attack were to occur the browser would
 inform the user that communications were not secure. When you do not use
 HTTPS each component (html, css, js) and all data is loaded independently,
 each possible of being tampered with in transit. Once the JS  is loaded
 you've already been compromised.

So what reasons might you still want to encrypt form data in JS? If you want
 the destination of that data to not know what it is. Often sites that store
 data that is only used client side will encrypt it before sending it to the
 server for storage. This way if the server is compromised your data won't
 be. Only when the data is sent client side, and then is decrypted with the
 users password is it visible. Password mangers and bookmarking apps are two
 examples of cases where the user data is encrypted in JS before being sent
 to the server for storage.

If you choose to encrypt in JS for this reason...you must still use HTTPS.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Submitting *encrypted* forms via AJAX bit-naughty@hotmail.com - 2018-06-25 02:48 -0700
  Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-25 22:03 +0700
    Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-25 17:21 +0200
      Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-26 14:59 +0700
        Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-26 16:47 +0200
          Re: Submitting *encrypted* forms via AJAX Richard Damon <Richard@Damon-Family.org> - 2018-06-26 21:09 -0400
            Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-27 09:45 +0200
              Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 00:54 -0700
              Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-27 13:29 +0000
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-27 15:47 +0200
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-27 16:00 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 08:11 -0700
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-28 01:53 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 21:48 -0700
                Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-28 09:17 +0000
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-28 03:25 -0700
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 14:04 -0700
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-28 13:54 +0200
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-28 13:46 -0700
  Re: Submitting *encrypted* forms via AJAX jecxjo <jeff@sh0.xyz> - 2018-07-02 03:21 +0000
    Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-07-15 04:56 +0200
      Re: Submitting *encrypted* forms via AJAX "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-07-16 01:00 +0200

csiph-web