Skip to main content

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
2 votes
7 answers
883 views

How can http data be compromised on a secure network?

I understand that it is bad to send passwords in plain text over the wire because somebody can look at it and clearly steal your information, and that the solution is to use HTTPS because the ...
user avatar
9 votes
2 answers
5k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
makerofthings7's user avatar
8 votes
1 answer
900 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. What ...
makerofthings7's user avatar
6 votes
7 answers
7k views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
Andrei Botalov's user avatar
4 votes
2 answers
3k views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access (...
makerofthings7's user avatar
22 votes
1 answer
7k views

Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites? The pitch is that if such a HTTP request were to come in, then certain XSS ...
makerofthings7's user avatar
11 votes
2 answers
2k views

When are HTTP session cookies at risk over Wi-Fi?

If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? Are cookies only at risk during login, or am I at risk ...
Chesnokov Yuriy's user avatar
8 votes
9 answers
532 views

What is the proper way to view the sourcecode of a website?

I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true? Does this mean the webserver may issue alternate source from the original? Lastly, is ...
makerofthings7's user avatar
13 votes
1 answer
3k views

Should I include a random padding in every HTTPS request and response?

According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle. Should I be sending a variable length ...
makerofthings7's user avatar
28 votes
4 answers
28k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
John Eipe's user avatar
  • 423
10 votes
2 answers
6k views

Are there any statistics about webservers and browsers TLS support?

From Hackers break SSL encryption used by millions of sites: The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
LanceBaynes's user avatar
  • 6,279
3 votes
3 answers
14k views

SSL verification of host name of https server

I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
Jim's user avatar
  • 1,415
-4 votes
2 answers
966 views

Web service that converts HTTP GET to POST? [closed]

Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST? For example, I'd like to give someone the URL: ...
itsadok's user avatar
  • 103
19 votes
1 answer
6k views

Strict Transport Security -- max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
Hubert Kario's user avatar
  • 3,808
27 votes
2 answers
12k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
tkit's user avatar
  • 3,362
11 votes
5 answers
17k views

Can I block the true IP address using X-Forwarded-For header in IIS?

All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address. Can I use the X-Forwarded-For header with ...
Bahi's user avatar
  • 187
3 votes
2 answers
3k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
mulllhausen's user avatar
1 vote
2 answers
11k views

How can I avoid sending passwords in plain text when logging into a website?

Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
Fel's user avatar
  • 131
2 votes
1 answer
4k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is it ...
Konrad Garus's user avatar
81 votes
10 answers
12k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
blunders's user avatar
  • 5,072
2 votes
2 answers
4k views

Strange 400 requests in webserver nginx logs (possible exploit scan?)

It's one of the logged by nginx webserver requests: ‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F or \213\\x11\303\273=\237&g\374\265\177\243\301\243x\254\270\220\300\311\365P\...
Somebody's user avatar
  • 131
4 votes
3 answers
1k views

How do you make sure a pdf is deleted after being viewed in the browser?

For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
Erlend's user avatar
  • 2,255
97 votes
9 answers
110k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
IAmARegisteredUser's user avatar
7 votes
2 answers
2k views

GET with additional parameters leads to "code injection" in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET /appdir/ajax/addAvail.php?counter=1216%3cscript%3ealert(0)%3c%2fscript%3e&from=1216%...
siliconpi's user avatar
  • 1,087
11 votes
6 answers
12k views

Security review: "HTTP header user-agent has been set to (something)"

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET /...
siliconpi's user avatar
  • 1,087
19 votes
5 answers
41k views

Can I block based on MAC address?

If I block an IP, the attacker can work around the block by taking a new IP or use a proxy. Is it possible to make a ban based on MAC address? I want to block at the webserver level so that unwanted ...
Geek's user avatar
  • 399
445 votes
9 answers
319k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
Morten's user avatar
  • 4,603
26 votes
2 answers
34k views

How does basic HTTP Auth work?

How does basic HTTP Auth work?
Moshe's user avatar
  • 1,861
19 votes
8 answers
1k views

Ways to secure yourself from Firesheep kiddies and other sniffing

Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions: In exactly what ...
Ricket's user avatar
  • 553
15 votes
13 answers
79k views

How can I intercept and modify HTTP requests?

Are there any free tools available that let me intercept and modify HTTP requests for testing? I am looking for tools which allow me to send custom HTTP headers.
James T's user avatar
  • 1,883

1
26 27 28 29
30