12

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so it may be vulnerable to XSS attacks. Since all the inputs are properly validated I am free from this issue.

But the other issue I found is the tampering of data while transferring to the server. Since my local storage session ID cannot be tagged under Secure, it is possible that it can be transmitted through an un-encrypted channel (HTTP). To mitigate this, I want to know if it is possible to access a page via HTTP which is secured with SSL.

  • 1
    It depends entirely on what the server allows, assuming it's the server you think it is. – OrangeDog Oct 24 '14 at 14:27
  • 4
    1. The answer to your question will depend on how the server behaves; we don't have enough information to say. Some servers will serve pages under both HTTP and HTTPS; some won't. What have you tried? Have you tried changing the https: in the URL to http: and trying to visit that address, to see how the server responds? 2. Why can't you tag the cookie secure? Have you looked at HSTS? What research have you done? – D.W. Oct 24 '14 at 16:02
  • 1
    "Since all the inputs are properly validated I am free from this issue." This is a dangerous mentality to have. Mistakes and oversights happen, which is why defense in depth is such an important concept in security – Stephen Touset Oct 27 '14 at 2:09
  • @Stephen Touset I appreciate that. Validation won't make perfect security. I agree. But since the topic of discussion wasn't related to that, I skipped it quickly to my topic. – Anandu M Das Oct 27 '14 at 8:09
  • @D.W I have done much research on it. I have tried changing https into http,tried some addons doing this, etc. Since I was totally unaware of HSTS i couldn't read much about this. Thank you for introducing that. – Anandu M Das Oct 27 '14 at 8:11
8

A page which is secured with SSL (or TLS for that matter) cannot be accessed via HTTP, as that would mean that the page is not secured anymore.

If I rephrase the question: Is it possible to access a particular page of a HTTPS secured website via HTTP, then I would say that is possible, but very INsecure. Moreover, the cookie with the session ID will probably have to be sent along with every page request, as you need to track the session across several pages. That would imply that you need to serve almost every page over HTTP, which thus renders your site insecure.

In case you need the session cookie on only one page, you could tell the client to carry out a HTTP request to that one page, which will then sent along all cookies that don't have the 'secure' flag set. However, this means that all these cookies are vulnerable to a MITM attack, and can be read by anyone listening in on your communication.

My advice: do not ever consciously serve a page of a HTTPS site over HTTP.

So, the question you need to ask yourself is why can't my session ID be tagged secure only. Is it laziness, or is there another reason why you cant tag this cookie as being secure?


By the way, to force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to OWASP for more information.

  • I understand that using cookies under an httpOnly and secure tag is the most safest method. But I asked this question only as a research purpose. Anyway thanks for the response. Up-voted. – Anandu M Das Oct 24 '14 at 12:21
2

Yes it is of course.

  • The simplest example is the user who just submits the request as http://..., either unconsciously or by will.
  • The (potentially malicious) web server could do that too, by just sending a 30x redirection or a page with all further hyperlinks pointing to http:// instead of https://

Example for the latter one: connect to https://www.amazon.com and you will land on a page without any SSL protection.

  • I appreciate the second case. But regarding the first case, if I try to access facebook or gmail via http, my browser won't allow me to do that. It redirects to https. – Anandu M Das Oct 24 '14 at 12:16
  • 5
    To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to owasp.org/index.php/HTTP_Strict_Transport_Security for more information. AFAIK, Facebook does not use HSTS, and uses normal redirects triggered on the web server. Gmail (in Chrome) does use HSTS. – Michael Oct 24 '14 at 12:27
  • No, the server doesn't allow you to do that. The browser just does what the server says. – OrangeDog Oct 24 '14 at 14:25
0

I think you ask about encrypt your data with ssl while accesing your server via http:// protocol. I guess would be a nice solution to avoid all sort of ssl warnings while still securing the important data.

I found very interesting that question and i will go ahead with trying that on my own server.

But, about the question, the server will not do that by default. Even if you can send ssl data trought http server listen interface the browser will not handle properly the data requested. Think about that the decrypting process of the ssl data is being when you reach a https:// url content, so im surely that will crash in any way whily fetching the encrypted one because will not understand the requests, by design.

If the goal is to let the normal people (with a normal browser) im near to 100% sure that the browser will not work with your requests.

If the goal is to send ssl data using an http procotol connection you need to hack/modify bot server and browser, and, over a traffic scan you will be recognized as an http connection with "unreadable" ssl encrypted data on it.

Very interesting question. I've started a little research about that.

-1

Yes it is

If TLS/SSL negotiation fails, then the browser fallback to HTTP (while staying over HTTPS port and the URL), the same way it can fallback to SSL3.
I took this screenshot while browsing GitHubproof of the first statement

  • Downvotes? Why? – user2284570 Oct 27 '14 at 20:55
  • Are you saying that a server will display a page unsecured if secure negotiation fails? – schroeder Oct 27 '14 at 21:14
  • I'm also not sure what you're screenshot is supposed to prove. How did you generate that message? – schroeder Oct 27 '14 at 21:21
  • @schroeder : Yes, if all protocol fails (all SSL version and TLS), then, the server can allow fallback to an unsecured (if configured) connection over https. This behaviour cannot be refused in major web-browsers. The Screenshot is took from my Web Browser (Opera 12.50). It tell the server failed to apply security measures, so the browser use a non secured connection (where security measures are the configured protocols list the browser advertise to support (they where all disabled for the screenshot)). – user2284570 Oct 28 '14 at 1:36
  • 2
    @schroeder: Yes this is possible depending on which cipher suites are made available. However, user2284570 you should have included some references (in English) to back this up in your answer. Extraordinary claims require extraordinary evidence. ;-) – SilverlightFox Oct 28 '14 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.