0

I have a website using HTTPS. I have set it up so that HTTP is redirected to HTTPS.

I also have a feature where the site exports a file for user to download.

Is that file transferred using HTTPS?

Edited to add screenshot of Chrome network console to show what I see.

enter image description here

  • Are you asking if the file transfer does happen over https (we can't know, take a look yourself) or if it should? – Xiong Chiamiov Jan 29 '17 at 17:29
  • I actually didn't think to check. But the question was more along lines of what should be expected. – curtisp Jan 29 '17 at 19:55
1

Web sites can't directly export files to a web browser; the browser must first make a request, and then the server responds to the request by sending some content. That is how (almost) everything on the web works, whether the content being served is web pages (HTML, CSS, etc.) or other content (like a file the server created for you).

This all matters because, for every request, it's the BROWSER that decides whether the request is sent over HTTP or HTTPS. The server has no actual say in this. The server can decide that the only thing it will do for HTTP requests is send a response that amounts to "try again, but over HTTPS" - this is probably what you mean by "set it up so that HTTP is redirected to HTTPS" - but if the request came in over HTTP, the response will go back the same way.

If you want to test, that's pretty easy. Open a web browser's developer tools (for most browsers, you can do this by right-clicking on any page and selecting "Inspect") and go to the Network tab. Go to your site and download the exported file. Look in the logged data in the dev tools (warning: there may be a lot of it) and see whether the request that made the server send the file went over HTTP or HTTPS. Whichever one the browser used, that's what the server used.

  • I added screenshot of network console. Its not clear to me if the file was downloaded using HTTPS. The console indicates the page was executed in HTTPS, but does that also indicate the file downloaded was too? – curtisp Jan 30 '17 at 17:31
  • 1
    Like I said, "Whichever one [of HTTP or HTTPS] the browser used, that's what the server used." If the file was retrieved in response to an HTTPS request, then the file was sent over HTTPS. The server can't send it not over HTTPS, in such a case; the connection between client (browser) and server is an HTTPS connection, and if the server is going to send the file at all, it has to use that HTTPS connection. – CBHacking Jan 31 '17 at 10:10
  • (The server could also do something like send an HTTP 3XX Redirect response to tell the client "make this request again, but over HTTP", but that's not sending the file; the client would have to make a new request to which the server might then choose to send the file via the new HTTP connection). – CBHacking Jan 31 '17 at 10:11
1

On a well configured web site I would expect file downloads, as well as pages, to be served over HTTPS, at least if the file downloads are hosted in the same domain as the rest of the site. However it's quite possible that site could be set up differently.

If the user is logged in to the site the browser will send the session ID cookie value to the site with every request, including those for download files. If someone can eavesdrop and obtain that session ID then they can hijack the user's session and perform any action the website allows while impersonating them.

  • This is a Django site with authentication so this could be possible but that is another question. – curtisp Jan 31 '17 at 13:37
1

screenshot of Chrome network console to show what I see.

Yes, that is downloaded over HTTPS in your screenshot.

If the link to the file starts with https://, or if the page that the link is on is already loaded over HTTPS but the link doesn't start with http://, then it is expected to load over HTTPS.

Of course, this assumes that there is no JavaScript trickery in custom code to rewrite links. And of course assumes that the server does not respond with a 30x redirect to plain HTTP. If not, you're good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.