RequireHttpsAttribute and Encrypted Request Data

Question

I have a controller action that is accepting sensitive data.

public ActionResult TakeSensitiveData(SensitiveData data){
 data.SaveSomewhere();
}

To ensure the data is secure I want to be certain requests are made using HTTPS (SSLv3, TLS 1). One of the approaches I've considered using was the RequireHttpsAttribute on my action:

[RequireHttps]  
public ActionResult TakeSensitiveData(SensitiveData data){
     data.SaveSomewhere();
}

However, upon testing this I fiddler revealed that an HTTP request made to the action is 302 redirected to HTTPS. My question is this:

If I've made a request that is 302 redirected to HTTPS haven't I already sent the sensitive data over HTTP before the redirect?

Answer 1

You need to post data directly to HTTPS.

Note: If you have sensitive data you must be entering it on HTTPS page anyway. So posting back would be HTTPS (or you'll get nasty warning from Firefox about posting HTTPS data to HTTP).