Linked Questions

0 votes
3 answers
4k views

Is http to https port forwarding a vulnerability? [duplicate]

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant ...
dev123's user avatar
  • 3
1 vote
2 answers
241 views

Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?

It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
user237462's user avatar
1 vote
1 answer
470 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
Utkarsh Agrawal's user avatar
13 votes
5 answers
8k views

How do you prevent sending cookie data over HTTP the first time? [duplicate]

You could use HSTS to tell browser to always use HTTPS in future requests. You could use Cookie Secure flag that from now on only send cookies over HTTPS. You could use DNS based redirect but only ...
Muhammad Umer's user avatar
2 votes
2 answers
657 views

Is https safe enough as of now?

Because of my job I keep traveling around Europe, which means I keep connecting to all kinds of public wireless. In principle I could use a VPN and that should be always safe (is this statement right?...
Scarlehoff's user avatar
1 vote
1 answer
273 views

Redirection HTTP to HTTPS, can I prevent giving away the URL?

Yes, yet another question on HTTP to HTTPS redirection. But this one talks about a quite quirky situation. This is a follow up question on Security of an initial redirection from http://example.com ...
grochmal's user avatar
  • 5,877
73 votes
6 answers
26k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
Franzech Domâs's user avatar
19 votes
2 answers
8k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
Mark's user avatar
  • 333
9 votes
7 answers
42k views

Disadvantages of Using a VPN?

I've got a yearly subscription to a VPN service which is real quick and from the research I did at the time seems to be pretty legitimate, but are there any disadvantages or scenarios where you ...
Crizly's user avatar
  • 2,617
5 votes
4 answers
986 views

Bank login in foreign country

I have friends andfamily that travel/live in foreign countries and compromised unsecure wireless networks and credit card scanners have always been a problem. I was recently asked a question about ...
BenW301's user avatar
  • 153
6 votes
1 answer
7k views

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources http://...
Gudradain's user avatar
  • 6,991
4 votes
2 answers
1k views

Data Security on a Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit some websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, ...
Peter's user avatar
  • 143
2 votes
3 answers
999 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
Paul Draper's user avatar
  • 1,010
8 votes
4 answers
7k views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
John's user avatar
  • 2,282
22 votes
2 answers
17k views

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
Gili's user avatar
  • 2,169

15 30 50 per page