1

I have a few questions, all relating to the title.

1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http?

2) Does SE do this / do many sites do this?

3) Is it less costly on the CPU to only do the cookies over HTTPS?

4) Are there any security risks to doing it this way as opposed to all over HTTPS?

I'm not very experienced in this area, so my apologies if I've made some incorrect assumptions.

  • 3
    To address the third point, HTTPS is cheap and fast. There is practically no reason not to go over HTTPS for everything. Some companies even use mutually-authenticated TLS for all of the traffic inside their datacenters. – Stephen Touset Aug 15 '14 at 22:08
  • 1
    Nowadays the only reason for not using HTTPS for everything is laziness. Certificates have become very cheap, the added CPU load has become negligible with modern hardware and having a shared hosting is no excuse anymore either since RFC 3546. – Philipp Aug 16 '14 at 1:36
4
  1. No. A response (and the associated request) is a single entity composed of headers (one of which is the cookies) and the body (in the case of the response, often HTML. They are not separate.

    Since the answer to question 1 is no, the answers to questions 2, 3, and 4 are also necessarily no, since this is not possible to do.

  • Interesting, thanks. Could you get around this by creating a temporary page on the server, e.g. sitename.com/2093nglkna2093lklfialongstringofcharacters and putting a javascript redirect to that page on that page that you initially sent out over HTTPS? That way, the cookies and the link to the HTTP-served page are sent over HTTPS but nothing else. I guess you'd have to make this page expire after a second so that someone listening in couldn't copy the HTTP-requested link and get there too. – AmadeusDrZaius Aug 15 '14 at 21:31
  • 1
    So, usually the point of cookies is that you want to use them. Either to identify the user, or for other purposes. If your cookies are marked "secure" and only sent over HTTPS, that means that all subsequent HTTP requests are going to be anonymous. That would seem to defeats the point. If you don't need cookies, don't set them. If you do, you probably need HTTPS. And in a roundabout way of answering question 3, a significant part of the cost of HTTPS is the initial handshake, so you're not gaining a ton by starting with a HTTPS request and then transitioning to HTTP. – Xander Aug 15 '14 at 21:41
  • Ah, well, if the handshake is the biggest part then yeah that probably wouldn't do much. – AmadeusDrZaius Aug 15 '14 at 22:19
  • What if you link a single resource (like a 0x0px image) via https and serve the rest via http? That would allow you to read and set a cookie when that resource is requested. Sure, there isn't really much you can do with such a cookie because it's unavailable for the main page, but I could imagine some very limited use-cases where this could be enough. – Philipp Aug 16 '14 at 1:28
  • 1
    @Philipp. That is completely insecure because if the main page is served over HTTP, than anything in that request is vulnerable to a man in the middle. Therefore, the URL for your single HTTPS resource could be overwritten by a malicious MitM to be an HTTP URL instead. Mixed HTTP and HTTPS content simply can't ever be trusted to be secure. – Xander Aug 16 '14 at 2:26
4

In addition to Xander's point that the HTML document is an entire structure, not separate elements:

The security of HTTPS is partially derived from the user recognizing that HTTPS is present. If the document were transmitted over HTTP and settings were over HTTPS, the browser would flag the page as HTTP, so the user would not have a way to recognize a secure page from a non-secure page.

Worse, if the base page is HTTP, a potential attacker could directly manipulate the content of the non-secure base page to modify the behavior of how it uses any secure content. This eliminates any benefits of using some secure elements in an insecure page, because there's no guarantee of security or correct functioning of the page.

  • 1
    Your last point is an important one. Thanks, Jeff. – AmadeusDrZaius Aug 16 '14 at 2:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.