Form HTTPS

Checks that form actions use HTTPS

Rule ID	security/form-https
Category	Security
Scope	Per-page
Severity	error
Weight	6/10

What it checks

form action and submit-button formaction values are resolved against the page URL, so a relative or protocol-relative action inherits the page’s scheme rather than being guessed at.

Outcome	When
pass	Every submission target resolves to HTTPS
warn	A page already served over HTTP submits to http://
fail	An HTTPS page submits to http://, downgrading the submission
info	Nothing on the page submits anywhere

Solution

Forms should always submit to HTTPS URLs to protect user data in transit. Update form action attributes from http:// to https://, and check formaction on any submit button that overrides the form. A form on an HTTPS page that posts to http:// is the worst case: the padlock tells the user they are safe while the submission itself travels in the clear, and browsers block or interstitial it. Be especially careful with login forms, payment forms, and any forms collecting personal data. For relative URLs, ensure the page itself is on HTTPS.

Enable / Disable

Disable this rule

[rules]
disable = ["security/form-https"]

Disable all Security rules

[rules]
disable = ["security/*"]

Enable only this rule

[rules]
enable = ["security/form-https"]
disable = ["*"]