The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
2
votes
3answers
1k views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
0
votes
1answer
2k views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a token-...
27
votes
5answers
14k views

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

With reference to some security paper I read, I found out that a cookie with the secure flag set can only be sent by the client over connections that are using HTTPS, not HTTP, but the cookie itself ...
9
votes
3answers
2k views

Are future TLS versions going to prevent traffic inspection?

Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
9
votes
2answers
2k views

Is this GET request an exploit attempt?

I've noticed a few requests like this to a Rails application I am maintaining: GET http://mydomain.com/?f=4&t=252751+++++++++++++++++++++++++++++++++++++++++Result:+%E8%F1%EF%EE%EB%FC%E7%F3%E5%EC+...
9
votes
1answer
3k views

Is it possible to have stateless server nonces in HTTP Digest

When implementing a HTTP Digest server, there's the issue of nonces. Server nonces (as opposed to client nonces) must be issued by the server may be re-used by clients as long as the server allows ...
8
votes
2answers
495 views

Can other customers on shared hosting see requests from/to my site?

I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account. The wiki ...
7
votes
3answers
2k views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
6
votes
1answer
445 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
5
votes
3answers
2k views

Link from a Http page to a Https page - is it a security issue?

I have a site which is mostly not an anything which needs to be protected. However there is a small part of the site which is only for logged in users. So my regular site is Http & the site of ...
5
votes
3answers
2k views

Session fixation attack

Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...
5
votes
1answer
5k views

How does the symmetric key get exchanged in SSL/TLS handshake?

I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory. Some say that the symmetric key that will be used to communicate between ...
5
votes
4answers
3k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
5
votes
2answers
1k views

How to defeat CRIME, BREACH, TIME etc… server side (without sacrificing compression)

I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment. ...
4
votes
2answers
3k views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
4
votes
1answer
8k views

Working of SSH connection through Proxy

I have to configure my web browser's proxy to 172.18.10.1:3128 every time I want to connect to internet from my college. Since I'm configuring a web browser's proxy, I believe that the proxy is a "...
4
votes
1answer
691 views

Highly anonymous proxies vs anonymous proxies

From this link about highly anonymous proxies: There’s another type of anonymous proxy called Highly Anonymous Proxy. The main difference with this one is the fact that aside from hiding your IP, ...
2
votes
3answers
822 views

Can a form submission be encrypted even though address bar shows HTTP?

I was going to apply for a Student ID card through ISIC, but noticed that the form where they ask for payment (such as credit card number) details is not available through HTTPS. The URL to their ...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
1answer
9k views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. https://stackoverflow.com/questions/27606232/hydra-from-kali-linux-tamper-http-post-form-syntax-of-the-...
2
votes
3answers
630 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: http://arstechnica.com/tech-policy/2014/...
2
votes
2answers
1k views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
0
votes
1answer
135 views

Have a HTTP or HTTPS website?

There were some questions regarding this topic, but none of them discussed if there is some expection, and if http is just enough for some kind of websites. I've seen lot of school/high school ...
12
votes
2answers
2k views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
6
votes
1answer
17k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
6
votes
3answers
2k views

Hide clear SNI when using https

A server with IP address a.b.c.d is hosting multiple SSL websites. When connecting to each website, a proper browser sends a request which include the destination host in an uncrypted clear text ...
5
votes
1answer
538 views

Accessing HSTS Server with an Unsupported Browser

Let's assume that I have correctly configured my server to enforce the HSTS policy, and it works correctly for IE 11 browsers. What happens when a someone using an unsupported browser (e.g., IE 9) ...
4
votes
1answer
590 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: David-...
4
votes
1answer
3k views

How come I can see a full HTTPS requests via Fiddler?

I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler. What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
4
votes
1answer
1k views

HTTP Digest Authentication: Does the server store plaintext passwords?

Having just finished the chapter on digest authentication in HTTP - The Definitive Guide, I'm not quite sure what the server stores as the client's secret† in its database: the client's plaintext ...
3
votes
7answers
2k views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
3
votes
1answer
65 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
3
votes
2answers
1k views

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Am I gonna run into XSS attacks by doing this, or will a file download be prompted? Are there security problems that would rise in a modern browser?
3
votes
1answer
185 views

Spam link returns empty redirect to google.com - am I missing something?

In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, ...
3
votes
1answer
187 views

Is there any purpose for providing checksums on a non-HTTPS location? [duplicate]

When you download a file, sometimes the website owner puts an MD5, SHA1, SHA256 or similar hash/checksum of the file right next to it; either on the page where you can download it, or as a separate ...
3
votes
2answers
611 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
2
votes
3answers
931 views

Is data exposed in a CSRF attack?

I am wondering wether a CSRF attack, will disclose the information being sent back in a GET request. I need to send a social security number out, to the client a few times, and it is NOT anyone else ...
2
votes
3answers
2k views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...
2
votes
1answer
122 views

Is it safe to put user-conrolled strings in a HTTP Location header?

I am thinking of adding URL shortening to my site. Let's say my database has already stored url as a plain string, this data was provided by the user and is arbitrary. So a naive implementation in ...
2
votes
1answer
610 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
2
votes
1answer
3k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is it ...
2
votes
1answer
2k views

Encrypting layers of OSI

I was reading that WPA2-PSK encrypts layer 2 of the OSI network model. What is the danger of having this layer in plaintext (I know it can be decrypted very easily from within the network)? Is there a ...
2
votes
2answers
3k views

Strange 400 requests in webserver nginx logs (possible exploit scan?)

It's one of the logged by nginx webserver requests: ‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F or \213\\x11\303\273=\237&g\374\265\177\243\301\243x\254\270\220\300\311\365P\...
2
votes
1answer
296 views

How does firewall differentiate between browsing and downloading?

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
1
vote
3answers
9k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
1
vote
3answers
5k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
1
vote
1answer
163 views

Security disadvantages of sending a password with GET? [duplicate]

Other than over your shoulder peeping, if a password is sent using GET in plaintext over an encrypted connection, are there any extra security disadvantages or is it the same as POST?
1
vote
1answer
390 views

Would the CORS specification consider a missing Content-Type header to imply a “simple header”?

RFC 7231, Section 3.1.1.5 states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...
1
vote
4answers
4k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following steps....
1
vote
1answer
121 views

Is it possible to intercept HTTPS payload with a trusted CA but send it the wrong server?

I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored ...