Is it possible, while being PCI compliant, to have a lightbox popup login that is secure (https) on a non-secure page (http)? If so, would it show the proper security icons/locks on the page?
Https (secure) lightbox login on a http page
1.4k Views Asked by Bobby At
1
There are 1 best solutions below
Related Questions in HTTP
- Handling both JSON and form values in POST request body with unknown values in Golang
- Why can't I use PUT requests?
- nginx set up reverse proxy from subfolder to a port
- Async Web Server RP2040 returning ERR_CONNECTION_REFUSED?
- Getting `FormatException: Missing extension byte (at offset 6)` exception for accessing `response.body` from a server deployed in Vercel
- Retrieving list of values from MYSQL data base based on input value(LARAVEL 10 )(GET HTTP METHOD)
- Unable to add request headers via CHttpFile - C++/MFC
- Why do we call all http services 'Web Api/Web Service'?
- How to correctly read POST REQUEST body on ESP32?
- on linux gitclone issue remote server error showing fatal error with proxy n port
- Elasticsearch - cascading http inputs from Airflow API
- How to clean the html pages opened in a session?
- UTF-8 is not a valid encoding name
- I dont get the Result i expected when i want to get my Telegram Chatbot id
- NextJS 14 SSE with TransformStream() sending messages in a single response
Related Questions in HTTPS
- HTTPS configuration in Spring Boot, server returning timeout
- HTTP Requests from SSL Secured(HTTPS) Domain Failing
- My VPS does not accept HTTPS requests on a port other than 443
- Let Artifactory use HTTPS settings
- How to move updates from Google Play to another server
- Does a 403 error occur if there is no user-agent on the proxy network?
- How to fix HTTPS on express-gateway
- Can we check whether s3 bucket is currently accessed via http in any 1 of the account
- java.lang.UnsatisfiedLinkError: org.apache.tomcat.jni.SSL.renegotiatePending(J)I
- How do I fix this "Internal Server Error" I keep getting?
- Permission denied error on pfx certificate in docker ASP.NET Core 8 HTTPS on Ubuntu
- Mac Sonoma 14.4 Dotnet 8.0.203 SDK webapi https error
- Connect to wss that uses the same port as the rest of backend using nginx
- TLS: failed to verify certificate: x509: cannot validate certificate for <IP> because it doesn't contain any IP SANs
- Preventing Data Tampering in HTTPS Requests: Safeguarding User-Initiated Donations
Related Questions in SECURITY
- HTTPS configuration in Spring Boot, server returning timeout
- HSM ZKA control mask values
- OWASP Amass Subcommands
- Is there a need for BPF Linux namespace?
- Error when trying to execute a binary compiled in a Kali Linux machine on an Ubuntu system
- When sanitize/encode while implementing tags system like on SO
- spring security version in spring-boot-starter-security
- I am currently trying to implement a rudimentary firewall from a video I watched but the nimda worm detection is not working and i do not know why?
- Is it possible for `sudo` to fail temporarily with the correct password? Hacking suspected
- Is it viable proxying all my mobile apps requests, to some kind knowing that a request is coming from a secure source
- What abilities should I concentrate on while bug hunting, and how can I improve the quality of my bug bounty reports?
- System.ArgumentOutOfRangeException: I passed this error in every single program
- How to prevent users from creating custom client apps?
- Does server-side content security policy exist for youtube video player API, app, mod apks and website?
- Can we pass a hostname/IP address as a query string in a GET request in REST API
Related Questions in PCI-COMPLIANCE
- Can I send encrypted Credit Card data to my non-PCI server for sending it to a PCI Credit Card Service? WITHOUT STORING THE DATA ON MY SERVER
- GKE & PCI DSS ASV Scans
- Credit card validation with Auth.net meeting PCI compliance
- is it possible to create a payment profile and a customer profile, using api, but in compliance with the pci compliance regulations?
- CVE-2021-38628 in nodeJs
- has anyone undergone certification of PCI-DSS using general purpose HSM (and not payshield)?
- Is it PCI compliant to create PaymentIntent directly from my Flutter app?
- PCI DSS Compliance when extracting data for analysis
- Masking Card Data Using log4j2
- Objective of PCI DSS 3.4 is only for physical theft of disk?
- Braintree how to use stored credit card for payments
- Displaying Credit Cards on User Profile
- GCP compliance manager - are there API to download reports?
- Tenable Nessus to approve PCI DSS: Microsoft ASP.NET MS-DOS Device Name DoS (PCI-DSS check)
- How do I perform a security scan on an Angular 7 app?
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular # Hahtags
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
This is vulnerable for multiple reasons. An attacker can just use SSLStrip to remove the https login and MITM the password.
Also why are you just using HTTPS for login? It should be used for the entire life of the session or or its completely and totally useless. You are violating OWASP A9 and this can be exploited with Firesheep.