are http forms posted thru https secure?
The thing your friend was trying to articulate is that if you deliver the FORM itself over plain http then it is not secure against MITM attacks, and so someone could conceivably intercept it and change the submit location of the FORM to be their own site, thus receiving every user’s login credentials (and then sending a fake error message or whatever) and you’d never know. By both delivering the FORM and receiving its POST over https you mitigate this type of attack. So yes technically the data submitted only happens on the POST and so you can just use https for that, but this assumes that the evildoer has not altered the destination of that POST.
