The example doesn't need to be that complex. Redirecting to within the same
site to force HTTP can cause a problem if the user continues to submit
sensitive information. Redirecting to another site is potentially a problem
regardless of whether HTTP or HTTPS, particularly if the user doesn't notice
the change and continues to behave as if he were interacting with the
original site.
Yep -- in general those prompts are there for a reason, and allowing the
website owner to disable them would make them useless and open up holes.
Granted the example was pretty bad, my creativity skills failed me while
typing up the response :-)
-Shawn
http://blogs.msdn.com/shawnfa
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Note:
For the benefit of the community-at-large, all responses to this message
are best directed to the newsgroup/thread from which they originated.
--------------------
> From: "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com>
> References: <CC2414DC-E478-4A70-AFDD-AA5823EBC505@microsoft.com>
<gwUVjhgFFHA.400@TK2MSFTNGXA02.phx.gbl>
> Subject: Re: Annoying: You are about to leave secure internet connection
> Date: Sat, 19 Feb 2005 13:09:17 -0500
[quoted text clipped - 8 lines]
> NNTP-Posting-Host: modemcable209.143-202-24.mc.videotron.ca 24.202.143.209
> Path:
TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP1
4.phx.gbl
> Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.dotnet.security:9145
> X-Tomcat-NG: microsoft.public.dotnet.security
[quoted text clipped - 69 lines]
> >>
> >> SK