13

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so it may be vulnerable to XSS attacks. Since all the inputs are properly validated I am free from this issue.

But the other issue I found is the tampering of data while transferring to the server. Since my local storage session ID cannot be tagged under Secure, it is possible that it can be transmitted through an un-encrypted channel (HTTP). To mitigate this, I want to know if it is possible to access a page via HTTP which is secured with SSL.

5
  • 1
    It depends entirely on what the server allows, assuming it's the server you think it is. – OrangeDog Oct 24 '14 at 14:27
  • 4
    1. The answer to your question will depend on how the server behaves; we don't have enough information to say. Some servers will serve pages under both HTTP and HTTPS; some won't. What have you tried? Have you tried changing the https: in the URL to http: and trying to visit that address, to see how the server responds? 2. Why can't you tag the cookie secure? Have you looked at HSTS? What research have you done? – D.W. Oct 24 '14 at 16:02
  • 1
    "Since all the inputs are properly validated I am free from this issue." This is a dangerous mentality to have. Mistakes and oversights happen, which is why defense in depth is such an important concept in security – Stephen Touset Oct 27 '14 at 2:09
  • @Stephen Touset I appreciate that. Validation won't make perfect security. I agree. But since the topic of discussion wasn't related to that, I skipped it quickly to my topic. – Anandu M Das Oct 27 '14 at 8:09
  • @D.W I have done much research on it. I have tried changing https into http,tried some addons doing this, etc. Since I was totally unaware of HSTS i couldn't read much about this. Thank you for introducing that. – Anandu M Das Oct 27 '14 at 8:11
9

A page which is secured with SSL (or TLS for that matter) cannot be accessed via HTTP, as that would mean that the page is not secured anymore.

If I rephrase the question: Is it possible to access a particular page of a HTTPS secured website via HTTP, then I would say that is possible, but very INsecure. Moreover, the cookie with the session ID will probably have to be sent along with every page request, as you need to track the session across several pages. That would imply that you need to serve almost every page over HTTP, which thus renders your site insecure.

In case you need the session cookie on only one page, you could tell the client to carry out a HTTP request to that one page, which will then sent along all cookies that don't have the 'secure' flag set. However, this means that all these cookies are vulnerable to a MITM attack, and can be read by anyone listening in on your communication.

My advice: do not ever consciously serve a page of a HTTPS site over HTTP.

So, the question you need to ask yourself is why can't my session ID be tagged secure only. Is it laziness, or is there another reason why you cant tag this cookie as being secure?


By the way, to force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to OWASP for more information.

1
  • I understand that using cookies under an httpOnly and secure tag is the most safest method. But I asked this question only as a research purpose. Anyway thanks for the response. Up-voted. – Anandu M Das Oct 24 '14 at 12:21
2

Yes it is of course.

  • The simplest example is the user who just submits the request as http://..., either unconsciously or by will.
  • The (potentially malicious) web server could do that too, by just sending a 30x redirection or a page with all further hyperlinks pointing to http:// instead of https://

Example for the latter one: connect to https://www.amazon.com and you will land on a page without any SSL protection.

3
  • I appreciate the second case. But regarding the first case, if I try to access facebook or gmail via http, my browser won't allow me to do that. It redirects to https. – Anandu M Das Oct 24 '14 at 12:16
  • 6
    To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to owasp.org/index.php/HTTP_Strict_Transport_Security for more information. AFAIK, Facebook does not use HSTS, and uses normal redirects triggered on the web server. Gmail (in Chrome) does use HSTS. – Michael Oct 24 '14 at 12:27
  • No, the server doesn't allow you to do that. The browser just does what the server says. – OrangeDog Oct 24 '14 at 14:25
-3

Yes it is

If TLS/SSL negotiation fails, then the browser fallback to HTTP (while staying over HTTPS port and the URL), the same way it can fallback to SSL3.
I took this screenshot while browsing GitHubproof of the first statement

16
  • Are you saying that a server will display a page unsecured if secure negotiation fails? – schroeder Oct 27 '14 at 21:14
  • 1
    I'm also not sure what you're screenshot is supposed to prove. How did you generate that message? – schroeder Oct 27 '14 at 21:21
  • 2
    @schroeder: Yes this is possible depending on which cipher suites are made available. However, user2284570 you should have included some references (in English) to back this up in your answer. Extraordinary claims require extraordinary evidence. ;-) – SilverlightFox Oct 28 '14 at 14:17
  • 1
    That screenshot says "Encryption protocol" "AES". Seems like you're still using https (http over TLS). The browser did not fall back to http. You're gonna have to do a little more digging to find out why the browser says the connection is insecure. Don't assume that it's because encryption is not being used. – Navin Jan 21 at 4:58
  • 1
    Says who? The browser says it's using AES. Post a wireshark screenshot showing plaintext in the packet and I'll believe you – Navin Jan 21 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.