Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS?

Some easy to implement ideas are

  • Implement HTTPS Strict Transport Security
  • Issue the authentication page over SSL
  • Use HTML Form-posts for the login page's submit button not CSS DIV's
    • ... why? the user can't see the target URL when they hover
  • Permit the client to cache the navigation page, as this will deter certain MITM attacks
  • Use SSL-Only cookies
  • Use an I-Frame Buster and the X-Frames-Options header
  • Edit the cipher list to only use RC4, AES or PFS

More advanced/technical options may include

Options that may break things (such as the user experience)

  • Disallow web browsers that:
  • Disallow port 80
  • Only allow redirects from a whitelisted set of domains. Don't permit someone to link to your site, and force the user to type in the HTTPS URL
  • Use a private certificate for all operations for that site. Issue the thumbprint (or RootCA) over a SSL connection

What are your thoughts on a website that implements some or all of these techniques?

What additional techniques would you recommend? (e.g. Use / Don't use OpenID, certain HTTP header directives, etc)

share|improve this question
1  
Related Pros and Cons of Site-wide SSL –  makerofthings7 Oct 1 '11 at 15:36

1 Answer 1

up vote 14 down vote accepted

The main ones are:

  • Use SSL sitewide. Don't offer anything over http. Instead, any connection via http should immediately redirect to the main site's landing page via https.

  • Use HTTPS Strict Transport Security. This will tell users' browsers: please, only connect to me over https. This defends against sslstrip and similar man-in-the-middle attacks.

  • Set the secure flag on all cookies. This will ensure that the cookies will only be sent over a https channel, never over an insecure http link.

  • Avoid third-party active content served over http. Don't load external active content over http. Make sure that any CSS, Javascript, widgets, analytics, or ads that you load from third-party sources are loaded over https.

    • Potentially better yet, you can consider making your own copy and serving these resources from your own server if possible, so you don't need to load them from a third-party source. In many cases you can avoid loading CSS, Javascript libraries, or widgets from third-party sources simply by storing a copy on your own server.

    • For analytics, note that Google Analytics does support https.

    • Ads are the hardest part. If you use ads, you may not have any choice but to accept third-party ads over http, which is a security risk. If you do, serve the ads in an iframe (do not use SCRIPT SRC to integrate the ads into your page).

    It is OK to load images hosted on a third-party host as long as they are loaded over HTTPS (to avoid mixed-content warnings).

I think if you do these four things, you'll cover most of the issues. The rest are details that can be evaluated on a site-specific basis, but they are probably secondary in importance (in my opinion).

If you want to get fancy, you can look at certificate pinning and similar emerging technology, but starting with the above four is already a significant enough project.

share|improve this answer
    
If images are loaded over HTTPS from a third party, then is there any real security benefit to hosting them yourself? What security breach can occur with an image over HTTPS? –  Justin Cloud Apr 9 at 20:30
1  
@JustinCloud, you are right. There's nothing wrong with loading images from third-party sites (if they are loaded over HTTPS). I will edit my answer accordingly -- thank you for catching that! –  D.W. Apr 9 at 21:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.