Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

In doing some research regarding SSL, I came across this topic. One of the common suggestions was not to serve content over HTTP. What does that mean from a website development POV? Referencing things like stylesheets with a full https URL? Something else?

share|improve this question
1  
You'll be safe following the same origin policy: ietf.org/rfc/rfc6454.txt – Henning Klevjer Nov 8 '12 at 15:16

2 Answers

up vote 4 down vote accepted

It means to always use the SSL layer when serving pages. Links don't need to be absolute, but traffic received on port 80 without SSL should be redirected to port 443 with SSL. The rest of the magic is in avoiding attacks where the user doesn't visit the SSL site first and the redirect is hijacked using something like SSLstrip. That is covered in this question: Options when defending against SSLstrip?

share|improve this answer
Hmmm... I think my options may be a bit limited from a development POV. Client wants a small e-commerce site, but can only afford a shared hosting solution at the moment. I can't go under the hood and disable pure HTTP access. Thankfully, further research shows I can enable HSTS programatically, so that's a plus. – KevinM1 Nov 8 '12 at 2:40
1  
HSTS requires HTTPS and doesn't work on IE, only Firefox and Chrome. Also, even on shared hosting, SSL (HTTPS) is usually an option, just look around for different offers. – Matrix Nov 8 '12 at 8:32
1  
@KevinM1 They can't afford a VPS for 15 dollars a month? – Polynomial Nov 8 '12 at 8:59
You can put in a 301 permanent redirect to the HTTPS site thereby disabling all HTTP access with a forced redirect? And in addition to what Matrix says, technically opera also supports HSTS and there is no harm in enabling it as long as everything on the domain is available over HTTPS and you are aware of the limitations. – ewanm89 Nov 8 '12 at 10:19
@Polynomial The client got scammed by her last developer/webmaster, so she's still trying to recover. I've been able to gain a portion of her trust by being straight with her (like I am with all my clients), but she's still very hesitant when it comes to expenses I suggest. I'm trying to meet her halfway. – KevinM1 Nov 8 '12 at 12:29
up vote 3 down vote

It means that all content and resources should be served over HTTPS (not HTTP). Local scripts, stylesheets, and images should be referenced with a URL that will ultimately load the resource over HTTPS, not HTTP.

One way to achieve this is to make sure that all URLs are absolute and fully qualified, and start with https:.

Alternatively, you can continue to use relative URLs, as long as you verify they will ultimately resolve to a https: URL.

For example, suppose you have a page https://example.com/foo.html. Here are some examples of snippets that are OK / not OK to include in that page:

  • OK: <IMG SRC="https://example.com/pic.png">

  • OK: <IMG SRC="/pic.png">

  • OK: <IMG SRC="https://elsewhere.com/pic.png">

  • OK: <IMG SRC="//elsewhere.com/cats.png"> (this is a relative URL, which uses the same protocol as the containing page, but a different host)

  • Bad: <IMG SRC="http://example.com/pic.png">

  • OK: <IFRAME SRC="https://example.com/bar.html">

  • OK: <IFRAME SRC="https://elsewhere.com/blah.html">

  • OK: <SCRIPT SRC="https://example.com/jquery.js">

  • OK: <LINK HREF="https://example.com/mystyle.css">

  • Bad: <SCRIPT SRC="http://somewhere.com/jquery.js">

  • Bad: <LINK HREF="http://somewhere.com/mystyle.css">

  • Bad: <IFRAME SRC="http://somewhere.com/blah.html">

I hope this makes sense.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.