1

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously.

Lets say a user requests the route user@pass:<url>/ping over HTTP. They can either be:

  • Redirected to HTTPS, not necessarily realizing their HTTP requests always get redirected, which means they can continue to do so.
  • Blocked. All attempts to HTTP are served with a "forbidden" response of some sort. They will realize, as they can't access the endpoint, but I guess the data sent is still revealed.

If a user sends a request with Basic Authentication header over HTTP, and it gets redirected to HTTPS, either as a rewrite or with HSTS in place, hasn't the information still been revealed?

If so, I'd imagine blocking HTTP would be a more effective way of telling the user to stop requesting the HTTP route. The redirect may never cause them to actually stop using HTTP for the initial request.

I have a feeling I might misunderstand some feature of the redirect that still preserves the security of the data being sent...?

|improve this question
2

If a user sends a request with Basic Authentication header over HTTP, and it gets redirected to HTTPS, either as a rewrite or with HSTS in place, hasn't the information still been revealed?

If the request is redirected to HTTPS (using a 30x response and a Location header), the authentication information has already been sent plain-text over the wire.

If HSTS is enabled, the HTTP connection won't be made and the authentication credentials are sent over HTTPS immediately. This is because Strict Transport Security tells the browser to connect directly over HTTPS.

Note that HSTS is trust-on-first-use and can expire, so it isn't an absolutely waterproof protection.

|improve this answer
  • The last line of this is important - if a user visits the HTTP version from a device which has not previously been used to view the HTTPS version, the credentials would be sent before the redirection (hence be revealed). If they visit from a device which knows about the HSTS status of the site, no connection will be made over HTTP, so no credentials are sent unencrypted. – Matthew Jun 25 '18 at 13:26
1

If the url / destination the data is being sent to first is HTTP it is being exposed in base64 form(what basic auth uses). The redirect goes to HTTP on flask then to HTTPS, so it is clear prior to the redirect.

Now if your flask app was using ssl and you have the redirect before requiring basic auth you’d be ok.

|improve this answer
  • Thank you. How does HSTS come into this? Are HSTS-redirects prior to any actual data being sent? – TragedyStruck Jun 25 '18 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.