Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
4answers
80 views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
0
votes
2answers
60 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
-1
votes
0answers
25 views

HTTP Header Request using TCP/IP [closed]

I want to perform a HTTP request but through a "crafted" tcp/ip packet. the procedure I followed is by sending the following through a connection opened to my server ip via port 80. I must mention ...
3
votes
2answers
508 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
1
vote
1answer
49 views

Is this behavior the result of malware?

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it ...
8
votes
1answer
311 views

How to convert http site to full https? [closed]

I have a site running only with http. I have decided I want to go full https, but I have no idea how to do this. Do I have to buy that certificate somewhere? Where, how much does it cost? Does it ...
5
votes
2answers
76 views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
0
votes
1answer
46 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
0answers
43 views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
1
vote
0answers
41 views

Can user identifying information in Dropbox be derived from subscription data?

I've noticed that my Dropbox installation really loves sending unencrypted information over the net including a "user_id" and it's user-agent. What i want to know is if it's possible at all to ...
1
vote
1answer
55 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
5
votes
2answers
153 views

Multi sub-domain login for content, spring security for main

Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not ...
10
votes
2answers
335 views

Can anyone recognise this sudden influx of malformed HTTP requests?

Starting around 3 weeks ago, my site started getting a lot of strange and recurring http requests from my users. I'm familiar with malicious scans which happen on a daily basis, but these requests ...
3
votes
1answer
50 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
2
votes
1answer
46 views

Browser - what gets saved to the disk

We run scraping jobs on behalf of users. We use webkit-gtk as browser to do the scraping. Each job is executed as a separate process So as not to mix user data we have isolated following data per ...
5
votes
2answers
142 views

Security sanity check

A company whose services I'm trying to integrate uses this protocol: An AES key is embedded in an Android library. To authenticate itself, the library sends a SHA1 hash of the key over plain HTTP. ...
1
vote
2answers
99 views

Block http HEAD, TRACE, DELETE OR TRACK requests is a valid security feature? [duplicate]

Block http HEAD requests helps us to solidify the safety rules for a Apache webserver or this restriction would be an exaggerated? What kind of vulnerability can be exploited by HEAD method? Tests: ...
17
votes
2answers
1k views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
0
votes
1answer
47 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
0
votes
2answers
168 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
3
votes
3answers
282 views

Why isn't it possible for a third party to decrypt HTTPS traffic? [duplicate]

I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof. My question is: Is that true or even possible. I mean there are lots of tools that allow ...
0
votes
2answers
72 views

How does HTTP Basic Auth persist across pageviews?

I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.
2
votes
1answer
89 views

Where do browsers store HTTP Authentication details

Where do browsers store HTTP Authentication credentials ? If I gain access to a browser, is there some place I can look where all HTTP Authentication details would be available? In most browsers, even ...
1
vote
2answers
62 views

Are MITM attacks possible on HTTP loopbacks?

I have a web server running at example.com. The web server performs a server-side request to example.com which results in a loopback, so the request never passes over the network. Is this request ...
1
vote
2answers
44 views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
1
vote
3answers
88 views

HTTP authentication: identify the client

We have a web-site, where each user has to log-in to access a private area. Inside the private area, there are some information about the user, a profile, including some sensitive information (home ...
0
votes
2answers
110 views

Is the lack of https reason enough to abort form submission?

Preamble: Am in awe about the quality of both questions and answers on https / SSL on this site. My humble question below pales in comparison. Both on professional and amateur websites I've ...
0
votes
5answers
221 views

Are all URL shorteners unsecure/vulnerable?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
0
votes
1answer
67 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
2
votes
2answers
295 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
0
votes
1answer
128 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
6
votes
3answers
1k views

Why can't we do MiTM attacks when using secure connection

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We ...
3
votes
2answers
382 views

Why do we need WTLS?

Please excuse my probably gross misunderstanding of how all this works. I just started reading SSL & TLS Essentials by Stephen Thomas, and in chapter 1 he talks about how TLS is a separate ...
2
votes
2answers
197 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
0
votes
2answers
51 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
0
votes
0answers
138 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
2
votes
2answers
112 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
4
votes
3answers
107 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
2
votes
2answers
301 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
4
votes
4answers
154 views

What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?

As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from. What are the privacy implications of ...
0
votes
1answer
73 views

Sending GET requests to non-servers?

I ran a couple of wireshark runs for my computer and noticed inbound GET requests. Is it legitimate traffic for there to be GET request traffic inbound to my home computer if my home computer isn't a ...
10
votes
3answers
916 views

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives ...
3
votes
1answer
72 views

Can we detect malicious redirections by retrieving the webpage's headers? [closed]

Is it possible to know if there are URL redirections (to malicious websites) by retrieving the HTTP request and response headers of the legitimate website ?
4
votes
2answers
690 views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
-2
votes
2answers
106 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
0
votes
1answer
92 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
0
votes
0answers
73 views

Will http only cookie work while using chrome bandwidth saving feature in Android?

I am developing a site which uses http only cookies for authentication. By design[w3 standard] these cookies are XMLHttpObjects and will only be submitted to the domain they originated from to prevent ...
1
vote
1answer
71 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
1
vote
2answers
99 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
0
votes
1answer
106 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...