4

Several answers on this site (e.g. 76305) suggest that HTTPS 30x redirects to HTTP aren't a great idea but that the pattern is widespread.

Looking at the choices that the Chrome team have made, it's clear that they consider their role to be proactive in security. It is foreseeable that browsers might start to deprecate, warn or even prevent HTTPS URLs redirecting to HTTP ones.

Is there any evidence of this blocking happening? If so any indications about the likelihood or timeframe?

| improve this question | |
  • it is a widly-used technique in russia for censorship and survelliance - they should be blocked, because they don't have any practical use – Alexey Vesnin Oct 11 '16 at 17:33
  • Yes they do. How do you run a link resolver that can redirect to any URL, whether HTTP or HTTPS, whilst making the service as secure as possible? That is a very practical use, and there are many examples. – Joe Oct 11 '16 at 18:01
  • And close-voters, please explain. I'm not asking for opinion I'm asking for evidence. – Joe Oct 11 '16 at 18:02
  • here is a proof of a recent attempt of russian ISP Rostelecom to hack a google session through such redirect s14.postimg.org/76rpuhqg1/google_hack_attempt_3.png – Alexey Vesnin Oct 11 '16 at 18:37
  • Thanks! As I said, I believe there are risks. I am asking a specific question about browser support. – Joe Oct 11 '16 at 18:40
3

An application can naturally leak sensitive information, such as an session token over an insecure channel using a HTTP 302 redirect. But this could happen in an attack, "hey click on http://authsite.com", which may make the browser send an HTTP request in the clear.

An application can protect session tokens using the secure cookie flag, which instructs the browser not to send the session token over an insecure channel.

Additionally, there is HTTP-Strict-Transport Security (HSTS), which will force the client to use HTTPS, even if there is a careless 302 redirect to HTTP. HSTS was created in a response to the SSLStrip attack.

All web applications must deal with insecure transmission, and it is a common server-side defect on the internet today. In the near future, chrome will use a broken lock icon on webapps that leak sensitive information.

| improve this answer | |
  • Thanks! I'm aware of the pitfalls. My question is specifically about web browsers preventing it in future. – Joe Oct 10 '16 at 22:05
  • Joe, browsers let you shoot yourself in the foot (just look at xss, csrf and clickjacking). Web apps need to tell the browser not to harm users. – rook Oct 10 '16 at 22:07
  • They used to to a greater extent. First came mixed-content policies, then came more and more prominent TLS, soon (already?) will come warnings for HTTP sites. I would not be surprised to see Chrome prohibit redirects from HTTPS to HTTP in the future. The question is, will this happen? – Joe Oct 10 '16 at 22:43
  • @Joe There is nothing inherently exploitable about an HTTPS->HTTP redirect. Web application developers have tools to deal with the problems caused by SSLStrip. – rook Oct 10 '16 at 23:30
  • 3
    @joe Where rook mentioned HSTS is how browsers plan to prevent this in the future. It just isn't enforced by default and only enabled if the server admin chooses to "opt-in". Enforcing it outright would instantly "break" a lot of websites and web applications that purposely or unintentionally operate with HTTPS to HTTP redirects. – Bacon Brad Oct 10 '16 at 23:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.