html 表单发送敏感数据 javascript https

Question

How do I securely send sensitive data like passwords to the server?

Is POST as a method enough? How do I enable https?

<form method="POST" action="/login">
  Password:
  <input type="password" name="pass">
  <button type="submit">
    Login
  </button>
</form>

Or when using an eventhandler for some button on the page, how do I enable https here:

button.addEventListener("click", function(event) {
  var xhttp = new XMLHttpRequest();
  xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
      // do something
    }
  };
  xhttp.open("POST", "/login", true);
  xhttp.send(<password>);
});

Answer 1

Use SSL or TLS.

Simply do. There are number of solutions. One of the most well known free solution is https://letsencrypt.org/ which is free. There are number of tutorial to use this kind of certificate on Apache, Node.js server or any others.