encrypted request from unencrypted page

[mtanner]

I have a aspx page that is not secured via SSL, and the page must
remain unencrypted. However, the page includes a web user control
(ascx) that contains textboxes and submit button for login. The click
event of the submit button is handled in the code behind of the user
control. The problem I have is that the username and password are sent
back to the server as clear text. How can I encrypted (with SSL) the
request/response content of the user control while leaving the rest of
the page unencrypted?

NOTE: I would also like to avoid the IE dialog that warns about secure
and non-secure content on the page.

Thanks,
-MT

 

[Patrice]

Try to change the action to point to an https page (and check as I'm not
sure if it will post securely or if it wiill just get the result securely).
IMO this is not a good practice as the user for example won't see the page
is secured...

As a site note, encryption should be totally transparent . You may want to
explain why not encrypting this page is a requirement.

Finally the warning is AFAIK a client side settings that is user
controlled... (avoiding mixing secure and non secure content would avoid it
else the user will have to disable it).

 

[Joerg Jooss]

I have a aspx page that is not secured via SSL, and the page must
remain unencrypted. However, the page includes a web user control
(ascx) that contains textboxes and submit button for login. The click
event of the submit button is handled in the code behind of the user
control. The problem I have is that the username and password are
sent back to the server as clear text. How can I encrypted (with
SSL) the request/response content of the user control while leaving
the rest of the page unencrypted?

Pages and UserControls don't exist at a HTML page level. It's all just
a huge chunk of HTML (text) that's either transferred encrypted or not
in its entirety.

Also, loading a login page via HTTP is inherently insecure, even if it
posts back via HTTPS. How can the user tell that he entered his
credentials on the real login page?

NOTE: I would also like to avoid the IE dialog that warns about secure
and non-secure content on the page.

Access all resources referenced by the page either by HTTP or HTTPS,
but don't mix them. Only then you can avoid the warning.

Cheers,