Why does mail.yahoo.com issue a GET request when the form says POST

[rvsw]

Hi
I have a question on how mail.yahoo.com webpage works. The answer may
lie in the fact that it uses javascript.

The problem is this:
mail.yahoo.com has two forms - one for signing up for the account and
another for signing into the account using login and password.

The form tag for the latter says
<form method=post action="https://login.yahoo.com/config/login?bkaghhq269hv3"
autocomplete=off name=login_form onsubmit="return
hash(this,'http://login.yahoo.com/config/login')">

The specified form method is thus POST. However, protocol trace always
shows that a GET is being issued. Also the GET is to
http://login.yahoo.com/config/login?bkaghhq269hv3
instead of
https://login.yahoo.com/config/login?bkaghhq269hv3 (i.e to http URL
instead of https URL)
I don't know javascript that much but is it possible that somehow the
form method /action is being altered by javascript
Thanks for any suggestions

 

[kaeli]

I don't know javascript that much but is it possible that somehow the
form method /action is being altered by javascript

Sure it can.

You'd have to look at their script to see. I suspect it is in their hash
function.

onsubmit="return
hash(this,'http://login.yahoo.com/config/login')"

What that does is call a function called hash and passes it a URL as a param
as well as the form('this'). In that function, they could easily do
form.target = "someOtherUrl";
form.action = "GET";

I'd look at it myself, but my company blocks yahoo mail.

HTH

--