Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement.

HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement.

HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

1504 questions
43
votes
3 answers

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing . I sought to do the same thing. But when I read the Apache documentation , it gives the opposite advice: Note Despite claims to the…
Question Overflow
  • 5,348
  • 6
  • 32
  • 51
43
votes
4 answers

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple to turn off as was done to deter CRIME. What can…
JoltColaOfEvil
  • 850
  • 1
  • 7
  • 13
43
votes
7 answers

Why is the HTTP protocol more susceptible to being intercepted than the BitTorrent protocol?

I'm downloading an .iso file that is offered through the main website, which recommends users to use BitTorrent. In addition, they offer the download via HTTP using different mirror sites that belong to different countries, and they claim that the…
noobandproud
  • 869
  • 2
  • 8
  • 9
40
votes
5 answers

Why do some websites enforce lack of SSL?

When trying to visit https://www.ebay.com , I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: https://www.ebay.com/ * Adding handle: conn:…
d33tah
  • 6,734
  • 8
  • 43
  • 63
40
votes
6 answers

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo> . I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now displays exactly https://example.com/ (no Unicode hack, no…
Gilles 'SO- stop being evil'
  • 52,796
  • 14
  • 128
  • 185
40
votes
8 answers

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
open source guy
  • 1,969
  • 9
  • 25
  • 29
40
votes
11 answers

Returning the wrong HTTP response code on purpose?

I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request. Of course, this is impossible. However, there…
Miles
  • 511
  • 1
  • 4
  • 6
40
votes
2 answers

CSRF with JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. Application throws an error if URL is requested…
Sachin Kumar
  • 870
  • 3
  • 9
  • 14
39
votes
5 answers

Should I use HTTPS on a domain that will only be used for redirection?

If I have a domain, https://www.example.com . It has an SSL certificate for that domain only. I also want to redirect people who only type example.com in their browser's address bar. Should I secure the second domain https://example.com and why, or…
Michel
  • 501
  • 4
  • 7
38
votes
4 answers

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a web server that allows only certain IP addresses. Can anyone connect that web server by IP spoof?
ibrahim
  • 661
  • 3
  • 8
  • 13
38
votes
2 answers

What is the HTTP "Server" response-header field used for?

It was not until recently that I began to question the use for the Server field in the HTTP Response-Header. I did some research: RFC 2616 states: 14.38 Server The Server response-header field contains information about the software used by the…
ZnArK
  • 597
  • 1
  • 6
  • 10
38
votes
3 answers

Is HTTPS URL in plain text at first connection?

Let’s say I have never connected to the site example.com . If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect to the site and therefore the crypto keys were…
user104545
  • 405
  • 1
  • 4
  • 4
37
votes
7 answers

Is it acceptable for an internal HR site to run over HTTP?

Our internal HR site - which has our personal details, payslips, holiday details etc. runs entirely off a basic http site. The site is only accessible within the company network, and can't be accessed e.g. by employees at home (except through a…
aldredd
  • 471
  • 1
  • 4
  • 5
37
votes
2 answers

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP requests in case of error is a common mistake, but…
niilzon
  • 1,629
  • 2
  • 11
  • 17
36
votes
9 answers

Use additional "password" in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/ . Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com , especially not my private site. Now let's say Alice…
unor
  • 1,779
  • 1
  • 19
  • 42
1 2
3
…
99 100