Encryption on a get method

[thamizhinpan]

Can I submit data with encryption on a get method form?

[penagate]

Yes if your form target is specified to use HTTPS.

<form method="GET" action="https://example.com/somewhere"> 

[manavo11]

What would that do penagate? What's the difference if it uses HTTPS?

[penagate]

The communication is encrypted using SSL.

[manavo11]

So the GET parameters don't show?

[penagate]

Well, that is a good point. Since GET parameters are appended to the URL you are better off putting sensitive data in a POST body.

[thamizhinpan]

I know that, But I don't know how to transfer data between 2 pages automatically (Without submitting by user) with post method.
So I do that

[manavo11]

One way would be to make a form, and then submit it by javascript. Might not be the best way though...

[killer7k]

You CANT at least if you use Post method

[visualAd]

You can!!!!!! But I wouldn't recommend it.

The query string is hidden when making an SSL request so you don't need to worry. Also, you shouldn't be transferring sensitive information back and forth even when it is encrypted; as you can store it in a server side session.

How SSL works:

1. A TCP connection on port 443 is first established with the server.
2. The client says hello. It also sends all its supported ciphers and key exchange protocols.
3. The sever sends its certificate and the client verifies the certificate and authenticates the server, usually by use of a digital signature.
4. Upon verification the client and server agree on a key exchange protocol and an encryption cipher.
5. The server and client exchange the key.
6. The HTTP request is then encrypted using this key and sent to the server:
   

   GET /index.php?value=secret&value2=versecret HTTP/1.1
   Host: www.example.com

7. When the server receives the encrypted request it uses the agreed key to decrypt it.
8. The server then encrypts the response with the agreed key and sends it back to the client.

See, no query string data ever gets seen between the two end points unencrypted. The only visible data are the source and destination IP addresses and the encrypted communications.