Web Security · Junior · Question 12 of 75
Why should a login form never be served over plain HTTP?
- ✓Correct answer: Anyone on the same network, such as public Wi-Fi, could read or change the password in transit
- 2Because HTTP doesn't support the
<form>element - 3Because passwords sent over HTTP are automatically logged by the browser
Explanation
Without TLS every byte travels in clear text. An attacker in the middle can capture credentials or inject a fake form.