2

I was working on a company's staging server today when I noticed that they are hosting their API's subdomain over an HTTPS connection while they are serving their user-facing dashboard over an HTTP connection. Does this pose a security risk? I know that HTTP provides no protection to data transmitted over the network, but I don't know if this will affect any HTTPS calls that are made after the page has loaded in a user's browser.

Also, a few notes: The company's dashboard is a single page application. I inspected the network traffic going on when you load the page and as far as I can tell all AJAX requests are being sent over HTTPS, including requests for logging in.

If this is a security risk, can you point me towards some official documents that I can use to persuade the company that they have an issue?

Improve this question

1 Answer 1

Reset to default
0

You have an HTTP dashboard that loads API content over HTTPS. This implies that if a man-in-the-middle attacker observes someone requesting the dashboard, they can arbitrarily modify the response and inject their own content, e.g. in a way that will reveal all subsequent API requests by the modified dashboard page to the attacker.

An attacker could achieve this by injecting JS code that with each API request also sends the response to an attacker-controlled domain or possibly by rewriting the requests to the HTTPS API to plain HTTP.

I don't know if this will affect any HTTPS calls that are made after the page has loaded in a user's browser.

After the HTTP site has loaded and only under the condition that the attacker cannot observe any plain HTTP requests afterwards (meaning the user never reloads the site), the attacker wouldn't have a chance to eavesdrop on any subsequent HTTPS requests to the API or modify any content.

(But they could trick the user into reloading the HTTP dashboard by blocking the HTTPS requests - making the user think there is a bug that could be fixed by reloading the site.)

Improve this answer
2
  • To expand on your example, does this mean all an attacker would have to do is inject some code that would run before any of the original javascript in the page is loaded, after which they could intercept any API requests that are made by the application?
    – Copernicus
    Commented Apr 30, 2017 at 3:14
  • @Copernicus Yes, if the attacker catches any plain HTTP request, be it to the HTML document or a JS file, they can modify the JS or inject their own <script src...> tag that could tamper with the calls to the API. Technically their code wouldn't have to run before the original script runs because they could also replace the API call function afterwards.
    – Arminius
    Commented Apr 30, 2017 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .