1

I have a domain, let say:

example.com

I also have a domain 

server.example.com

which points to my Elastic Beanstalk.

I've written some rule, that redirects certain traffic from example.com to server.example.com (thus my Elastic Beanstalk):

example.com -> server.example.com -> elasticbeanstalk

Now, on my example.com I've got a wildcard SSL (*.example.com, is active on both example.com and server.example.com).

I've also updated that certificate to the Elastic Beanstalk loader.

Now, I am wondering If this set up is secure?

|improve this question
3

For client redirect : If all domains use https AND HSTS, then the redirect is as safe as possible.

For server "proxy": If they are on the same server http is probably fine. If they are in the same internal network, http is not a good idea. If internet is between them, http is not safe at all. For https, make sure the servers check the validity of the certificates.

|improve this answer
  • What would be the case, if elasticbeanstalk wouldn't have installed SSL? – uksz Nov 24 '16 at 17:39
  • If they are on the same server it's probably fine. If they are in the same internal network, not really good. If internet is between them, not safe at all. – Tom Nov 24 '16 at 18:06
  • sorry for bother - last follow up question. What if the traffic between example.com and server.example.com goes via http? – uksz Nov 24 '16 at 18:17
  • @uksz the same. I've updated the answer. TL;DR: always use https (except for communication inside the same server) – Tom Nov 24 '16 at 20:14
1

The security of the setup depends on the unknown security of the different sites. The redirect by itself does not add any security or insecurity.
The sharing of the same certificate between different sites might add some insecurity if these sites are served by different hosts which thus all need to have the same private key installed. This increases the risk of compromise since it the chance is higher that one of several hosts has a security problem than only a single host.

|improve this answer
  • The redirect/proxy do add insecurity if not encrypted and sent over the network! – Tom Nov 25 '16 at 9:41
  • @Tom: exactly. But this is not a problem of the redirect but of the original security of the sites. If the sites are only available with HTTPS the redirects will be HTTPS too. If the sites are available with HTTP the HTTP redirect does not make it less secure than it already is. It is not possible to do a HTTP only redirect to/from sites which do only HTTPS. That's why I said it depends on the unknown security of the sites. – Steffen Ullrich Nov 25 '16 at 10:04
  • Yes, but if done not carefully, the redirect may decrease security, for example if the target use http and https but the redirect use http, or or the redirect use https but do not check the certificate. – Tom Nov 25 '16 at 10:32
  • @Tom: certificate validation is unrelated to redirect. The validation is done by the browser for every access to the site and not only if the access was caused by a redirect. Skipping the validation is therefore not a problem related to the redirect. If the target offers http and https then again it is a problem of the original site which might be highlighted by a redirect but also by any direct access to the site. – Steffen Ullrich Nov 25 '16 at 11:03
  • By "redirect" I think @uksh means "proxy" or back-end redirect. But even with "browser redirect" it may be less secure to redirect: if you redirect to example.com , even if example.com use https and redirect http to https, it's less secure, you should redirect directly to the https version. It's one example of what can go wrong. – Tom Nov 25 '16 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.