I was using wireshark and expecting to see a JSESSIONID in a HTTP request, but it did not seem to be there for HTTP requests. I could see my own JSESSIONID however. Would upgrade-insecure-requests help protect a query string form sniffing?
I was using wireshark and expecting to see a JSESSIONID in a HTTP request, but it did not seem to be there for HTTP requests. I could see my own JSESSIONID however.
JSESSIONID is a cookie that is usually flagged with the "secure" and "no script" flags. The "secure" flag tells compliant browsers to not send that cookie over HTTP, only HTTPS.
Would upgrade-insecure-requests help protect a query string form sniffing?
The HTTP Upgrade-Insecure-Requests request header sends a signal to the server expressing the client’s preference for an encrypted and authenticated response... more: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests
If the server receives the request with
Upgrade-Insecure-Requests: 1 it can redirect the client that expressed the preference for secure requests to the HTTPS version of the site.
Query string is part of the URL in the request. The URL appears in the request line of the HTTP request:
GET /some/url?a=b HTTP/1.1
To protect it from sniffing you need SSL/TLS that establishes a secure TCP session before sending data and then encrypts the communication/data.
First of all using HTTP to transmit sensitive data is not a good idea whether you use query strings or any other mechanism because you are vulnerable in many ways. Even if you are using HTTPS, there are many aspects you need to consider when you are deploying.
protect a query string
I think you are concern about attacks such as XSS and SSRF here ? If you are using data in query string you must perform data sanitation , URL encoding and most importantly server side data validation as well before you process your data.