CI 3.x. I want to use CI helper form_open() to generate a simple login form because it can do anti-csrf automagically. Looking at the first step:
<?php echo form_open("foo/fum");?>
...
But the generated code specifying the action
<form action="http://www.example.com/foo/fum" method="post" accept-charset="utf-8">
...
is flagged by SSL checker missingpadlock.com as insecure -- currently the only flaw on my almost-ready-to-deploy site. I think this should be
<form action="https://www.example.com/foo/fum" method="post" accept-charset="utf-8">
...
but I cannot see a way tell the helper to prefix 'https:'. Obvious workaround: don't use form_open(), just straight PHP code to generate the form, but this means learning how to explicitly generate the anti-csrf function -- which I don't feel qualified to do -- or not using it.
Am I missing something incredibly obvious? It's very possible...
Meta-question: The site's security needs are minimal: login and logged-in users can change their own password and view restricted material -- that's all. I'm using a standard auth package which incorporates anti-brute-force. Maybe I don't need anti-csrf. How would I decide?
TIA
