Potential issues with a HTTPS to HTTP conversion

Question

I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL. I found the following information on potentially resolving the issue. https://tusksoft.com/blog/posts/9/how-to-force-pages-to-not-use-ssl-in-asp-net-mvc-by-creating-a-forbidhttpsattribute

The author mentions that there are potential issues with reversing the operations of a forced HTTPS operation to allow conversion to HTTP. Can anyone please expand on these potential issues? I am curios, because this could resolve my current issue, but I do not want to create any potential vulnerabilities without understanding them more thoroughly, or preventing them entirely.

Update: to clarify the question a bit more. I am asking specifically about the potential types of threats that could be passed over a non HTTPS connection on a public facing site.

Answer 1

The issue that they're referring to is sensitive cookie exposure, in particular, cookies that contain an authentication or session token. In this case specifically, you should never force an authenticated user to HTTP, and allow them to remain authenticated. This used to be a common practice, even among very large web properties until a tool called Firesheep demonstrated how catastrophically unsafe it was.

So, if you use authentication or session cookies to identify specific users, or cookies that contain any sensitive data, those cookies should be marked with the "secure" flag, which will prevent them from being sent alongside HTTP requests, and limit them to HTTPS requests only.

Generally speaking though, in this day in age, there aren't many good reasons to do this in any case. I'd think long and hard about forcing HTTPS to HTTP, and prefer protecting everything with HTTPS whenever possible.

Answer 2

I am experiencing an issue with certain emails coming from exterior services such as yahoo, and google. Specifically that requested resources can only be accessed via SSL.

Okay, so you receive an email, and it contains links to encrypted (https://) content.

there are potential issues with reversing the operations of a forced HTTPS operation to allow conversion from HTTP. Can anyone please expand on these potential issues?

Quite simply, the author/publisher of the content that you are viewing decided, based on their own reasons and cost/benefit analysis, to use encryption. If you take it upon yourself to go out of the way and force an unencrypted (http://) request, then you are overriding their decision.

Maybe they are in marketing and specified the colorful banner image to use https because it was easy and compatible with everything else. There's no particular value to that image which needs to be protected by encryption. No big deal...

...On the other hand, maybe they are sending you to a page with sensitive data:

• Maybe they are sending you to a page which asks for credentials.
• Maybe they are sending you to a page that sets cookies that become important later.
• Maybe they are just sending a really, really good story that you'd like to read but a content-based web filter might raise an eyebrow at.

Whichever the case, they chose to encrypt. If you choose to override what they've chosen, then there's a decent chance you will have exposed something you didn't bargain for.