Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
11
votes
4answers
5k views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
0
votes
1answer
83 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
0
votes
1answer
324 views

Is there any security advantage to hiding URL parameters?

I am building a web app that needs to be secure. Is there any security advantage to hiding path parameters? I am using Angular (I don't know if this is important). What I mean by hiding path ...
0
votes
1answer
233 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
2
votes
2answers
18k views

Exploiting HTTP redirect function via the Host header

I am testing a web application and found a redirect function which seems to be insecure. If I visit a non-existing page, then I am getting redirected to login page of application. However the redirect ...
2
votes
2answers
170 views

Clickjacking vulnerability of file attachment downloads?

A portion of our system exposes an HTTP file handler that transmits a file to the client provided that authentication and file ID are correct, and no response if not. The ASP.net server this is ...
11
votes
1answer
3k views

To avoid BREACH, can we use gzip on non-token responses?

I work on a site that has a web interface an an API. I'm trying to determine if we can safely use gzip, or if that will open us to BREACH. The site says: If you have an HTTP response body that ...
12
votes
1answer
1k views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
0
votes
1answer
1k views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
2
votes
1answer
208 views

Why are many Security sites not using HTTPS?

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
25
votes
2answers
7k views

Why is my computer making requests to my Roku about spotify?

I'm new to inspecting packets with Wireshark so this might be something very stupid on my part. That said, I don't really understand the transaction between my computer and my Roku. 17 1.129097 ...
32
votes
10answers
14k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
0
votes
0answers
45 views

How to read SlowHTTPTest range attack when Nginx is the server?

I'm running an application hosted on Firebase and did some tests using SlowHTTPTest. For SLOW HEADERS, SLOW BODY, and SLOW READ the output is quite similar, i.e. the service is available which makes ...
0
votes
2answers
174 views

How does someone know i clicked a link in an email? URL spoofing? JSON?

How do hackers/scammers know that I clicked a link? Why is my personal info in the url redirect link? Is this info then being stored in a database and the hacker/scammer knows that because this ...
0
votes
2answers
102 views

Can I intercept and impersonate a server over an HTTP wireless connection?

Let's assume I have a strong enough antenna at exactly the same frequency as the victim. If it sends a request over unprotected http to the router, could I then listen to that request and respond to ...
1
vote
1answer
147 views

Is it safe to use personal wiki over http?

I hosting my site on infinityfree.net for free and dokuwiki is installed there. Couple of my colleagues, including me, are going to use wiki for writing documentation for our project. Wiki is private,...
18
votes
3answers
6k views

How secure is HTTP / HTTPS over 3G?

Suppose I log into a website, such as Twitter, from a 3G-enabled smartphone or similar device. How secure is this from interception? Can someone steal my password or login? What if I use HTTPS? What ...
3
votes
3answers
325 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
0
votes
1answer
162 views

Preventing path traversal knowing only the input

I am tasked with preventing a path traversal attack over HTTP by intercepting and inspecting the (unencrypted) transported data without direct access to the target server. From some research it ...
0
votes
2answers
49 views

What is the use of private key of a SSL certificate? [duplicate]

I have read a few wrong information about HTTP/SSL (I think) and those information was saying that the private key from a certificate is used for message decryption. I have followed a tutorial on ...
0
votes
1answer
161 views

How Hathaway ISP shows renewal reminder in non secure website?

I am using prepaid broadband plan of Hathaway (in India). Few more days are left for the plan to get expired and I observed the below screenshot. This popup comes only when I visit any non-secure ...
0
votes
0answers
70 views

Should I hash responses from server?

I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers. Should I also do this on the responses from the ...
48
votes
2answers
64k views

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
3
votes
1answer
66 views

Should the Strict-Transport-Security max-age be tied to the duration of the certificate?

I understand the principle of HSTS, and the fact that the choice of max-age limits how long a visitor could potentially be locked out if the site somehow lost its certificate and had to go back to ...
1
vote
0answers
50 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1
vote
2answers
130 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...
0
votes
0answers
24 views

How can I authenticate websocket over HTTP connection? [duplicate]

I have to communicate over HTTP connection only. A WebSocket server is setup in Tomcat. A web application is also running on the server. Now, I have a scenario in which a client will login into the ...
1
vote
1answer
90 views

Serving local HTTP over VPN [closed]

I’m running a server on my LAN. It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server. When I’m not at home, I establish a connection to the vpn. The ...
1
vote
3answers
4k views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
2
votes
1answer
90 views

Correctly configuring load balancing for TLS session resumption

Consider the following network topology: There are exactly two HTTPS servers, S1 and S2. There are exactly two HTTPS clients, C1 and C2. Notice this, as there are often many more clients for two ...
4
votes
1answer
232 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
2answers
106 views

Non SSL website with external SSL secured service

I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
2
votes
1answer
98 views

Is <meta> http-equiv secure?

I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page. I can handle this via the backend code, but it's easier to make it using HTML. ...
2
votes
2answers
6k views

Is there any way capture HTTPS Request with Python?

I created a simple python script to capture HTTP request. I captured HTTP Requests with my python script. But I can't capture HTTPS requests. I just want to capture information about URLs. I used ...
-2
votes
1answer
449 views

Digest authentication - client side [duplicate]

Possible Duplicate: Client side password hashing How one design support for digest authentication in client side. HTML form probably won't help. Does one need javascript and set the header ...
0
votes
0answers
53 views

How does Google restrict API access by mobile App ID?

Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers. How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
1
vote
0answers
59 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
17
votes
3answers
34k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
12
votes
3answers
11k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
1
vote
3answers
210 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
0
votes
1answer
49 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
-9
votes
2answers
169 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
1
vote
2answers
402 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
1
vote
1answer
96 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
22
votes
3answers
6k views

Security vulnerabilities of POST over SSL

I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can ...
1
vote
0answers
61 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
2
votes
1answer
87 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
3
votes
1answer
190 views

Is it easy to hijack browser session if you have access to someone else computer

If someone has access to my computer , can they easily get my session id by going to the browsers developer tools and taking a photo of the session id with a phone, if the session id is passed in a ...
42
votes
1answer
85k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
3
votes
2answers
456 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...