blocks|key|342192|text|SSL是必须的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|342193|POST方法并不比GET更安全，因为它也是通过网络以未加密的方式发送的。|342194|SSL将覆盖整个HTTP通信，并对客户端和服务器之间传输的HTTP数据进行加密。|342195|entityMap^0|0|8|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|P|8|@]|D|@]|E|$]]|$1|J|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|K|$]]

SSL is a must.

POST method is not more secure than GET as it also gets sent unencrypted over network.

SSL will cover the whole HTTP communication and encrypt the HTTP data being transmitted between the client and the server.

blocks|key|3320612|text|HTTP我有一个blog+post，它详细说明了<shameless+plug>请求的外观，以及GET请求与POST请求的比较。为了简洁起见，GET：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3320613|GET+/?page=123+HTTP/1.1+CRLF
Host:+jasonmbaker.wordpress.com+CRLF
User-Agent:+Mozilla/5.0+(Macintosh;+U;+Intel+Mac+OS+X+10_5_6;+en-us)+AppleWebKit/525.27.1+(KHTML,+like+Gecko)+Version/3.2.1+Safari/525.27.1+CRLF
Connection:+close+CRLF|code-block|syntax|javascript|3320614|和帖子：|3320615|POST+/+HTTP/1.1+CRLF
Host:+jasonmbaker.wordpress.com+CRLF
User-Agent:+Mozilla/5.0+(Macintosh;+U;+Intel+Mac+OS+X+10_5_6;+en-us)+AppleWebKit/525.27.1+(KHTML,+like+Gecko)+Version/3.2.1+Safari/525.27.1+CRLF
Connection:+close+CRLF
CRLF
page=123|3320616|(+CRLF只是一个换行符)|3320617|正如您所看到的，从请求如何构成的角度来看，唯一的区别是POST请求使用POST一词，表单数据是在请求的主体中发送的，而不是URI。因此，使用HTTP+POST是隐蔽的安全性。如果你想保护数据，你应该使用SSL。|3320618|注意，这里有+other+differences。|3320619|entityMap|0|LINK|mutability|MUTABLE|url|http://jasonmbaker.wordpress.com/2009/05/10/http-and-you/|1|http://jasonmbaker.wordpress.com/2009/04/29/make-sure-you-use-the-right-method/^0|O|G|8|9|0|0|0|0|0|0|0|6|I|1|0^^$0|@$1|2|3|4|5|6|7|14|8|@$9|15|A|16|B|C]]|D|@$9|17|A|18|1|19]]|E|$]]|$1|F|3|G|5|H|7|1A|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1B|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|1C|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|1D|8|@]|D|@]|E|$]]|$1|Q|3|R|5|6|7|1E|8|@]|D|@]|E|$]]|$1|S|3|T|5|6|7|1F|8|@]|D|@$9|1G|A|1H|1|1I]]|E|$]]|$1|U|3|-4|5|6|7|1J|8|@]|D|@]|E|$]]]|V|$W|$5|X|Y|Z|E|$10|11]]|12|$5|X|Y|Z|E|$10|13]]]]

<code>&lt;shameless plug&gt;</code>I have a <a href="http://jasonmbaker.wordpress.com/2009/05/10/http-and-you/" rel="noreferrer">blog post</a> that details what an HTTP request looks like and how a GET request compares to a POST request. For brevity's sake, GET:

<pre><code>GET /?page=123 HTTP/1.1 CRLF
Host: jasonmbaker.wordpress.com CRLF
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.1 Safari/525.27.1 CRLF
Connection: close CRLF
</code></pre>

and POST:

<pre><code>POST / HTTP/1.1 CRLF
Host: jasonmbaker.wordpress.com CRLF
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.1 Safari/525.27.1 CRLF
Connection: close CRLF
CRLF
page=123
</code></pre>

(The CRLF is just a newline)

As you can see, the only differences from the standpoint of how a request is formed* is that a POST request uses the word POST and the form data is sent in the body of the request vs the URI. Thus, using HTTP POST is security by obscurity. If you want to protect data, you should use SSL.

<code>*</code> Note that there <a href="http://jasonmbaker.wordpress.com/2009/04/29/make-sure-you-use-the-right-method/" rel="noreferrer">are other differences</a>.

blocks|key|3320340|text|这取决于您的情况，拦截凭据需要花费多少钱？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3320341|如果只是登录到一个软件Q%2BA站点，那么SSL可能不是必要的，如果它是一个在线银行站点，或者您存储信用卡数据，那么它是必要的。|3320342|这是一个商业决定，而不是一个技术决定。|3320343|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

That depends on your circumstances, how much would the interception of the credentials cost somebody?

If it's just a login to a software Q+A site then SSL might not be necessary, if it's an online banking site or you store credit card data then it is. 
This is a business not a techncial decision.

blocks|key|3107548|text|HTTP+POST未加密，它可以被网络嗅探器、代理截获，或者以自定义的日志级别泄漏到服务器的日志中。是的，POST比GET更好，因为POST数据通常不是由代理或服务器记录的，但它不安全。要保护密码或其他机密数据，您必须在发布之前使用SSL或对数据进行加密。另一种选择是在浏览器中使用摘要式身份验证(请参阅RFC+2617)。请记住，(本地的)加密不足以防止重放攻击，您必须连接nonce和其他数据(例如。域)，然后再加密(参见RFC2617了解如何在摘要身份验证中进行加密)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3107549|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

HTTP POST is not encrypted, it can be intercepted by a network sniffer, by a proxy or leaked in the logs of the server with a customised logging level. Yes, POST is better than GET because POST data is not usualy logged by a proxy or server, but it is not secure. 
To secure a password or other confidential data you must use SSL or encrypt the data before you POST. Another option would be to use Digest Authentication with the browser (see RFC 2617). Remember that (home grown) encryption is not enough to prevent replay attacks, you must concatenate a nonce and other data (eg. realm) before encrypting (see RFC 2617 for how it is done in Digest Auth).

blocks|key|338749|text|SSL是必须的:)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|338750|HTTP帖子以纯文本传输。例如，下载并使用Fiddler查看HTTP流量。你可以很容易地在那里看到整个帖子(或者通过像WireShark这样的网络流量监视器)|338751|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

SSL is a must :)

HTTP Post is transmitted in plain text. For an example, download and use Fiddler to watch HTTP traffic. You can easily see the entire post in there (or via a network traffic monitor like WireShark)

blocks|key|339905|text|这是不安全的。帖子可以像GET一样容易被嗅探到。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|339906|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

It is not secure. A POST can be sniffed just as easily as a GET.

blocks|key|337409|text|No...POST根本不够安全。SSL是必须的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|337410|POST只会有效地隐藏查询字符串中的参数。任何查看浏览器和端点之间的流量的人仍然可以获取这些参数。|337411|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

No...POST is not secure enough at all. SSL is a MUST.

POST only effectively hides the parameters in the query string. Those parameters can still be picked up by anybody looking at the traffic in between the browser and the end point.

blocks|key|338879|text|最安全的方法是根本不发送凭据。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|338880|如果你使用Digest+Authentication，那么SSL必须是而不是。|offset|length|style|BOLD|338881|(注意:我并不是说通过HTTP的摘要式身份验证总是比通过HTTPS使用POST更安全)。|338882|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Digest_access_authentication^0|0|Z|3|5|L|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@$D|T|E|U|F|G]]|9|@$D|V|E|W|1|X]]|A|$]]|$1|H|3|I|5|6|7|Y|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

The most secure way is to not send credentials at all.

If you use <a href="http://en.wikipedia.org/wiki/Digest_access_authentication" rel="nofollow noreferrer">Digest Authentication</a>, then SSL is NOT a must.

(NB: I am not implying that Digest Authentication over HTTP is always more secure than using POST over HTTPS).

blocks|key|3320351|text|POST是纯文本的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3320352|安全的连接是必须的。|3320353|这就是为什么它被称为安全连接。|3320354|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

POST is plaintext.

A secure connection is a must.

That's why it's called a secure connection.

blocks|key|3320380|text|POST请求本身并不安全，因为所有数据都是以纯文本“传输”的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3320381|你需要SSL来保证它的安全性。|3320382|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

A POST request alone is not secure because all the data is "traveling" in plain text.

You need SSL, to make it secure.

blocks|key|3320389|text|否，使用SSL。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3320390|使用POST时，除非使用SSL，否则值仍以纯文本形式提交。|3320391|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

No, use SSL.

With POST the values are still submitted as plain text unless SSL is used.

blocks|key|337471|text|HTTP+GET和HTTP+POST之间的唯一区别是数据的编码方式不同。在这两种情况下，它都是以纯文本形式发送的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|337472|为了为登录凭据提供任何类型的安全性，HTTPS是必须的。|337473|您也不需要昂贵的证书来提供HTTPS。有许多提供商将颁发大约20美元的非常基本的证书。更昂贵的包括身份验证，这是电子商务网站更关心的问题。|337474|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

The only difference between HTTP GET and HTTP POST is the manner in which the data is encoded. In both cases it is sent as plain-text.

In order to provide any sort of security for login credentials, HTTPS is a must.

You do not need an expensive certificate to provide HTTPS either. There are many providers that will issue very basic certificates for about $20USD. The more expensive ones include identity verification which is more of a concern for e-commerce sites.

blocks|key|337541|text|请看这篇很棒的文章：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|337542|防止恶意POST请求|offset|length|style|BOLD|337543|https://perishablepress.com/protect-post-requests/|337544|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|A|0|0|1E|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@$D|S|E|T|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|U|8|@]|9|@$D|V|E|W|1|X]]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|I]]]]

Please see this great article:

Protect Against Malicious POST Requests

<a href="https://perishablepress.com/protect-post-requests/" rel="nofollow">https://perishablepress.com/protect-post-requests/</a>

blocks|key|337464|text|如果您使用的是未加密的HTTP连接，则POST数据将以纯文本发送。这是否足够安全取决于您的使用情况(提示:不是)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|337465|如果服务器、客户端机器和它们之间的所有机器都是受控的、完全受信任的网络的一部分，这可能是可以的。|337466|在这些非常有限的环境之外(有时甚至在其中)，纯文本身份验证是在自找麻烦。|337467|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

POST data is sent in plain text if you are using an unencrypted HTTP connection.
IF this is secure enough depends on your usage (hint: it's not). 

If both the server, the client machine and ALL MACHINES BETWEEN THEM are part of a controlled, fully trusted network, this may be ok. 

Outside of these very limited circumstances (and sometimes even within them) plain text authentication is asking for trouble.

Is a POST secure enough to send login credentials over?

Or is an SSL connection a must?

How secure is a HTTP POST?

身份验证

服务器

POST是否足够安全，可以发送登录凭据？或者是必须的SSL连接。

问HTTP POST有多安全？
EN

回答 14

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问HTTP POST有多安全？EN

回答 14

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问HTTP POST有多安全？
EN