Linked Questions

2 votes
3 answers

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
Paul Draper's user avatar
  • 1,010
1 vote
1 answer

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website Now, you also have an SSL certificate, which means users can access the site securely using But if I just write ...
Utkarsh Agrawal's user avatar
2 votes
2 answers

Is https safe enough as of now?

Because of my job I keep traveling around Europe, which means I keep connecting to all kinds of public wireless. In principle I could use a VPN and that should be always safe (is this statement right?...
Scarlehoff's user avatar
2 votes
2 answers

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
Phoenix Logan's user avatar
1 vote
1 answer

Redirection HTTP to HTTPS, can I prevent giving away the URL?

Yes, yet another question on HTTP to HTTPS redirection. But this one talks about a quite quirky situation. This is a follow up question on Security of an initial redirection from ...
grochmal's user avatar
  • 5,877
1 vote
2 answers

Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?

It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
user237462's user avatar

15 30 50 per page