In Drupal 7, $form['#https'] can be set to force a form to be submitted via HTTPS.

This patch adds an HTTPS option to the form advanced settings. If checked, $form['#https'] is enabled on the webform.

CommentFileSizeAuthor
webform-https.patch2.63 KBmfb

Comments

quicksketch’s picture

quicksketch
he/him
commented
Status: Needs review » Needs work

Thanks for the patch @mfb. I didn't know this property existed.

I'm a little skeptical about the need to add it however. It seems like if you wanted to use HTTPS on a form, you'd want the page to reflect that also and have the page loaded as HTTPS to begin with (maybe through a module like Secure Pages for example). A lot of sites out there don't have SSL to begin with, I'm worried that this could potentially cause users a lot of headaches if they try to enable something that their server doesn't support.

mfb’s picture

mfb
they or he
commented

I agree that for proper security, the whole page should load via HTTPS, if $form['#https'] is TRUE. A contrib module I maintain - http://drupal.org/project/securelogin - actually does just that for any form with $form['#https'] enabled.

I could theoretically add this functionality for securing webforms in Secure Login (or a sub-module thereof) but seemed like it would make sense to propose adding it to Webform directly.

quicksketch’s picture

quicksketch
he/him
commented

I think for the time being, I'd like to avoid adding such an option to Webform. It seems like an option that should be enforced by the site developer, rather than bothering the end-user (the target audience for Webform) for such a value.

mfb’s picture

mfb
they or he
commented

OK. My take on this is: Webform allows non-developers to create forms that the developer didn't even know about, so there is some rationale to expose it in the (advanced) UI.

ryoken’s picture

ryoken commented

the whole page should load via HTTPS, if $form['#https'] is TRUE

I agree, this would be a really useful feature to have with webforms. If the particular form is "flagged" as secure, then that particular webform page will load via https and submit via https.

edit: I just stumbled across this module: http://drupal.org/project/webform_ssl. But I would still prefer the requested feature by mfb instead (I'd rather avoid running dev/beta modules on a production site).

mfb’s picture

mfb
they or he
commented

Sadly webform_ssl only works with Secure Pages module, not my Secure Login module (Secure Pages module requires the site to use less secure mixed-mode HTTP/HTTPS sessions and also requires hacking core). So I would say there is still good reason to include this functionality in webform.

It seems reasonable for webform module to make a nice core Form API feature - $form['#https'] - easily usable by site admins.

ryoken’s picture

ryoken commented

It looks like the latest version of the Secure Login module (version 1.4) allows all pages with webforms to automagically upgrade to a HTTPS session! I only realised this after re-saving the configuration for Secure Login :)

quicksketch’s picture

quicksketch
he/him
commented

Thanks @ryoken! That's a useful tip! Yeah at this point pretty much all information submitted should be HTTPS. But I'm still not sure how I feel about this being an end-user facing option.

danchadwick’s picture

danchadwick commented
Issue summary: View changes
Status: Needs work » Closed (won't fix)

7.x-3.x is only receiving critical bug fixes. Does not seem appropriate for webform core at this point.