Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
436 votes
9 answers

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
Morten's user avatar
  • 4,513
421 votes
5 answers

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
Anmol Gupta's user avatar
  • 4,311
242 votes
5 answers

What is the difference between and

Is it there any difference between the encrypted Google search (at and the ordinary HTTPS Google search (at In terms of security what were the ...
BlueBerry - Vignesh4303's user avatar
152 votes
4 answers

Which security measures make sense for a static web site?

I have a static web site. Users cannot log in or perform any other actions. Which of the common HTTP security measures make sense for my site? Do I need any of these? HTTPS Strict transport security ...
Sjoerd's user avatar
  • 29.6k
134 votes
4 answers

Is it safe to include an API key in a request's URL?

Lately I've seen plenty of APIs designed like this: curl "" Isn't it elementary that passing an API key in a query string as a part of ...
Incerteza's user avatar
  • 2,257
122 votes
8 answers

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and svrloc:...
hsnm's user avatar
  • 1,291
112 votes
6 answers

Why should I offer HTTP in addition to HTTPS?

I am setting up a new webserver. In addition to TLS/HTTPS, I'm considering implementing Strict-Transport-Security and other HTTPS-enforcement mechanisms. These all seem to be based on the assumption ...
lofidevops's user avatar
  • 3,610
97 votes
9 answers

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as they can't see what I'm doing on the site since all ...
IAmARegisteredUser's user avatar
88 votes
7 answers

Does a CSRF cookie need to be HttpOnly?

We were recently handed a security report containing the following: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix ...
alecxe's user avatar
  • 1,585
80 votes
10 answers

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
blunders's user avatar
  • 5,062
74 votes
3 answers

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
Digital fire's user avatar
  • 3,186
72 votes
6 answers

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
Franzech Domâs's user avatar
71 votes
3 answers

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
Crazy Dino's user avatar
  • 1,527
70 votes
8 answers

Why use HTTPS Everywhere when we have HSTS supported browsers?

I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say, the response header ...
GypsyCosmonaut's user avatar
66 votes
5 answers

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...
Peque's user avatar
  • 663
65 votes
4 answers

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
Tom Marthenal's user avatar
63 votes
3 answers

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

I saw in my Apache2 server logs messages like [ssl:error] [pid 28482] AH02032: Hostname xxx.yyy.zzz.www:443 provided via SNI and hostname xxx.yyy.zzz.www provided via HTTP are different One of ...
Sir Cornflakes's user avatar
63 votes
7 answers

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
Andrew Russell's user avatar
60 votes
3 answers

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
Andy Smith's user avatar
  • 2,762
56 votes
2 answers

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
Mark Amery's user avatar
  • 1,817
55 votes
5 answers

Should I disable HTTP HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
hnn's user avatar
  • 1,027
54 votes
1 answer

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
josh3736's user avatar
  • 2,395
51 votes
9 answers

Is it bad practice to use GET method as login username/password for administrators?

I work on web applications and as you know, having an administrator panel is a must in most cases. We can see that a lot of web applications have a specific login page for administrators in which ...
Amirreza Nasiri's user avatar
51 votes
5 answers

Any reason NOT to set all cookies to use httponly and secure

Assuming a site is using all HTTPS all the time (LB redirects port 80 to 443), is there any reason not to force every cookie set by the application to use BOTH secure AND httponly? Currently, for ...
user2145893's user avatar
51 votes
2 answers

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
bitmoe's user avatar
  • 611
50 votes
4 answers

Is SSL dying? Should I buy SSL certificates for my sites any more?

I'm planning to purchase a SSL certificate for one of my sites when I'm concerned about points made in these articles: WiredTree: The Most Significant Issue With SSL – And How To Solve It ...'s user avatar
  • 749
50 votes
6 answers

Is there any difference between HTTP and HTTPS when using my home / own internet connection

First of all I am a web developer and not a security expert. I have read lots of articles about the difference between HTTPS and HTTP, including this site. The basic idea I got from them is, when ...
I am the Most Stupid Person's user avatar
45 votes
3 answers

Can I trust the source IP of an HTTP request?

As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
KajMagnus's user avatar
  • 707
43 votes
7 answers

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
SamTest's user avatar
  • 695
43 votes
7 answers

Why is the HTTP protocol more susceptible to being intercepted than the BitTorrent protocol?

I'm downloading an .iso file that is offered through the main website, which recommends users to use BitTorrent. In addition, they offer the download via HTTP using different mirror sites that belong ...
noobandproud's user avatar
43 votes
4 answers

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm using ...
Aditya M P's user avatar
42 votes
4 answers

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
JoltColaOfEvil's user avatar
41 votes
5 answers

Why do some websites enforce lack of SSL?

When trying to visit, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L * Rebuilt URL to: ...
d33tah's user avatar
  • 6,534
41 votes
3 answers

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives ...
Question Overflow's user avatar
40 votes
11 answers

Returning the wrong HTTP response code on purpose?

I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request. ...
Miles's user avatar
  • 511
39 votes
5 answers

Should I use HTTPS on a domain that will only be used for redirection?

If I have a domain, It has an SSL certificate for that domain only. I also want to redirect people who only type in their browser's address bar. Should I secure ...
Michel's user avatar
  • 501
39 votes
8 answers

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website ( using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
open source guy's user avatar
39 votes
2 answers


I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
Sachin Kumar's user avatar
39 votes
2 answers

What is the HTTP "Server" response-header field used for?

It was not until recently that I began to question the use for the Server field in the HTTP Response-Header. I did some research: RFC 2616 states: 14.38 Server The Server response-header ...
ZnArK's user avatar
  • 607
39 votes
5 answers

Security of an initial redirection from to

Suppose that<foo> systematically redirects to<foo>. I enter in my browser's URL bar, and I see a page load and the URL bar now ...
Gilles 'SO- stop being evil''s user avatar
37 votes
9 answers

Use additional "password" in Referer to hide private site?

I have a private (= I'm the only user) site at Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at, ...
unor's user avatar
  • 1,779
37 votes
7 answers

Is it acceptable for an internal HR site to run over HTTP? [closed]

Our internal HR site - which has our personal details, payslips, holiday details etc. runs entirely off a basic http site. The site is only accessible within the company network, and can't be ...
aldredd's user avatar
  • 471
36 votes
3 answers

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site If this site is https and I write will the URL be sent in clear text since it's the first time I connect ...
user104545's user avatar
36 votes
2 answers

How to prevent users from executing commands through browser URL?

I have very little experience with security (still learning) however was combing through my logs and I noticed the following request: "GET /index.php?s=/index/\\think\\app/invokefunction&function=...
user3718908's user avatar
36 votes
4 answers

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a web server that allows only certain IP addresses. Can anyone connect that web ...
ibrahim's user avatar
  • 631
36 votes
2 answers

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
niilzon's user avatar
  • 1,619
34 votes
10 answers

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
Ulkoma's user avatar
  • 8,783
34 votes
4 answers

Is it something to worry about when my browser warns me that my connection to (router admin page) is not secure?

I got this "Not secure" warning when I'm trying to log in to my router (it's within my physical access). Apparently my router's management (admin) system doesn't have HTTPS. Chrome also says Your ...
iBug's user avatar
  • 1,378
34 votes
6 answers

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

With reference to some security paper I read, I found out that a cookie with the secure flag set can only be sent by the client over connections that are using HTTPS, not HTTP, but the cookie itself ...
mfs's user avatar
  • 531
33 votes
9 answers

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
kepe's user avatar
  • 465

2 3 4 5