使用HTTP而非HTTPS发送登录凭据安全吗？

Question

提交包含纯文本用户名和密码的HTTP POST是否安全，还是完全需要HTTPS？

Answer 1

HTTPS is required. All HTTP traffic can be sniffed.

Answer 2

No, HTTP alone does not give you any security at all. If someone is able to read the network traffic, they would be able to read the credentials too.

The network traffic might also be protected separately, but you can't control the network. But you can control your application. So HTTPS ist a must.

Answer 3

It's never safe to send an unencrypted, plaintext username and password over a wire others have access to.

While it's safe to send encrypted data over HTTP, HTTPS does this for you, giving you the added benefit of TLS . Given how well it stands up theoretically and in practice, it's far more compelling to use than inventing your own algorithm.