Yes, yet another question on HTTP to HTTPS redirection. But this one talks about a quite quirky situation.
This is a follow up question on Security of an initial redirection from http://example.com to https://example.com and Link from a Http page to a Https page - is it a security issue?. After reading both I got worried about a small hack that I use trying to prevent:
- The issues outlined in the first question.
- Giving away the URLs the user access.
My original purpose with this hack was because an URL of the form
HTTP/1.1 301 Moved Permanently Location: https://example.org/article/<hash>/some-country-does-something-bad/
Gives away the information that this article actually exists on the page.
Instead I return this (more-or-less, with all the bloat removed):
HTTP/1.1 404 Not Found <!DOCTYPE html> <html> <head></head> <body> Please visit the page securely at <a href="https://example.org">https://example.org</a>. </body> </html>
But now I'm vulnerable to SSLstrip. Bummer.
- I perform this because the majority of the page is available through HTTP, but some sensitive content isn't.
- I cannot switch the page completely to HTTPS because the advertisers (the font of income, so it is quite important) do not support TLS.
- I do not use HSTS.
- I never ever set any cookies in HTTP, and all cookies are marked
sha1of the content of the article, unless you have a link you simply cannot scan random URLs.
- The users (well, most of them) are clever enough to understand that they need to change the URL by hand.
Can I get rid of the SSLstrip issue? Or, maybe, there is a better way to perform this?
(Probably there is a better way, this thing is terribly hacky, but I could not think of a cleverer way to make it work)