Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
91 votes
9 answers
105k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
user avatar
39 votes
5 answers
10k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
user avatar
58 votes
3 answers
9k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
user avatar
  • 2,732
80 votes
10 answers
11k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
user avatar
  • 5,042
21 votes
5 answers
6k views

Is including a secret GUID in an URL Security Through Obscurity?

I know that this question is a little bit on the side of Opinion/Discussion, but I think there's a provable answer to it. I think the common view of "Security Through Obscurity" is that the security ...
user avatar
401 votes
10 answers
274k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
user avatar
  • 4,163
63 votes
4 answers
18k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
user avatar
56 votes
2 answers
87k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
user avatar
  • 1,777
25 votes
2 answers
1k views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
user avatar
  • 714
15 votes
4 answers
26k views

What information can my ISP see when I visit a website? [duplicate]

For example, when I enter this URL: https://www.google.com/search?q=example or http://www.google.com/search?q=example I can see the word example that I was searching on Google. Can the ISP see this ...
user avatar
  • 427
28 votes
4 answers
27k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
user avatar
  • 423
30 votes
4 answers
30k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a web server that allows only certain IP addresses. Can anyone connect that web ...
user avatar
  • 551
72 votes
3 answers
150k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
user avatar
  • 3,116
33 votes
11 answers
39k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
user avatar
  • 464
22 votes
8 answers
6k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
user avatar
22 votes
1 answer
6k views

Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites? The pitch is that if such a HTTP request were to come in, then certain XSS ...
user avatar
19 votes
1 answer
14k views

If SSL encrypts urls, then how are https messages routed?

I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
user avatar
  • 1,437
25 votes
1 answer
6k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
user avatar
  • 373
121 votes
8 answers
9k views

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and svrloc:...
user avatar
  • 1,281
40 votes
3 answers
42k views

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives ...
user avatar
13 votes
4 answers
38k views

POST over HTTPS "secure enough" for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
user avatar
  • 313
20 votes
4 answers
11k views

Can URLs be sniffed when using SSL? [duplicate]

I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc... The thing I saw is my session ...
user avatar
11 votes
1 answer
552 views

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
user avatar
11 votes
6 answers
11k views

Security review: "HTTP header user-agent has been set to (something)"

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET /...
user avatar
  • 1,087
8 votes
3 answers
23k views

Is it possible to send HTTP packet via spoofed IP?

I have the following PHP code that writes accepted to a file named text.txt only if the IP is equal to 127.0.0.1 (loopback). If the IP doesn't match it writes denied. <?php $file = fopen('text.txt'...
user avatar
1 vote
1 answer
563 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday,...
user avatar
  • 155
0 votes
2 answers
1k views

What is the use of private key of a SSL certificate? [duplicate]

I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on ...
user avatar
  • 103
49 votes
2 answers
72k views

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
user avatar
  • 591
43 votes
4 answers
15k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
user avatar
34 votes
10 answers
21k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
user avatar
  • 8,773
14 votes
3 answers
38k views

Is it safe to access HTTP sites from Tor?

Somewhere I read that you should only open HTTPS links on Tor because otherwise your ISP for example could read the webpages you visit. I searched on the subject and somewhere else I read that the ...
user avatar
  • 279
125 votes
4 answers
26k views

Is it safe to include an API key in a request's URL?

Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...
user avatar
  • 2,147
28 votes
1 answer
25k views

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
user avatar
  • 409
69 votes
6 answers
22k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
user avatar
54 votes
5 answers
34k views

Should I disable HTTP HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
user avatar
  • 987
36 votes
8 answers
96k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
user avatar
16 votes
7 answers
17k views

Are URL parameters of GET and POST requests over HTTPS secure?

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure. If I change the request to POST, and use HTTPS, then the parameters are in the ...
user avatar
  • 1,964
41 votes
5 answers
8k views

Why do some websites enforce lack of SSL?

When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: ...
user avatar
  • 6,514
36 votes
3 answers
10k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
user avatar
24 votes
2 answers
42k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
user avatar
  • 343
10 votes
1 answer
16k views

Can VPN provider see my data?

I have a 2 questions: If I use a VPN and I go to any websites via HTTP - does VPN provider will be able to see the traffic? Those. logins, passwords, all the texts that pass through the channel (in ...
user avatar
  • 497
7 votes
3 answers
3k views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...
user avatar
  • 3,945
2 votes
1 answer
2k views

Understanding a suspicious HTTP request

While debugging my server for issues, I checked my logs frequently. Here is one weird one I've found, which seems like an attempt to run something on my server. I am using nginx on Ubuntu 14.04. Below ...
user avatar
11 votes
2 answers
2k views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
user avatar
4 votes
1 answer
195 views

Can you prove to a 3rd party, that a HTTPS TLS session took place? [duplicate]

Alice is a (potentially modified) browser/client. Bob is a non-modified HTTPS web server running common security practices. Eve is collecting data from Bob from many Alices, Eve needs this ...
user avatar
4 votes
1 answer
11k views

Are GET parameters secure over https? [duplicate]

Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and ...
user avatar
  • 169
1 vote
2 answers
725 views

Preventing malicious usage from users with access tokens

So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
user avatar
15 votes
13 answers
73k views

How can I intercept and modify HTTP requests?

Are there any free tools available that let me intercept and modify HTTP requests for testing? I am looking for tools which allow me to send custom HTTP headers.
user avatar
  • 1,853
82 votes
7 answers
48k views

Does a CSRF cookie need to be HttpOnly?

We were recently handed a security report containing the following: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix ...
user avatar
  • 1,505
38 votes
2 answers
38k views

CSRF with JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
user avatar

1
2 3 4 5