Hi, I wanted to secure only the form in the User Login Block and not interested in securing the rest of the pages. I've done the following...

/**
 * implement hook_form_alter
 */
function my_form_alter(&$form, &$form_states,$form_id){
	if($form_id == 'user_login_block'){ //if the form is user_login_block
		global $base_url;
                       //create an absolute URL with protocol set to HTTPS for the form['#action'] attribute.
		$form['#action']= str_replace('http','https',$base_url) . $form['#action']; 
	}
}

this functionally seems to work, any opinion for from security experts if this "really" secures the login (user/password) submission?
Thanx

Comments

sukr_s’s picture

for records...this is what the new sso does.