4 ms·
The article recommends: > Don’t allow plain HTTP any more. Make sure your servers insist upon HTTPS connections, and update your client software to use HTTPS ex
by tqkxzugoaupvwqr 8y ago
The article recommends:
> Don’t allow plain HTTP any more. Make sure your servers insist upon HTTPS connections, and update your client software to use HTTPS exclusively.
Does this mean I should turn off HTTP completely? Right now, I redirect any incoming HTTP requests to HTTPS. Is this considered insecure?
- Ndymium 8y agoUsing HTTP to redirect to HTTPS is fine, but you should augment it with HSTS (to instruct browsers to always go to HTTPS) and HSTS preload (to let browsers know to go for HTTPS even before they visit your site the first time).
- ptx 8y agoIt's insecure because whoever intercepts the unencrypted HTTP request could redirect it anywhere, i.e. to their evil site instead of your secure site. But if you set the Strict-Transport-Security header[1] that will tell the client to go directly to HTTPS in the future, without needing to be redirected, so future requests will be secure as long as the initial redirect request is not intercepted. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St...
- icebraining 8y agoAllowing HTTP is not insecure; if someone can intercept the connection, they can do so even if you don't have HTTP enabled.
- ptx 8y agoHmm? What could they intercept if you only have HTTPS (with properly checked valid certificates) other than the (useless to the attacker) encrypted data? Preventing that kind of thing is the whole point of SSL. If you enable communication without SSL it's not prevented, so it's less secure.
- icebraining 8y agoI'm saying that if the client tries to connect to HTTP/80 and the attacker has interception abilities, it doesn't matter if the legitimate server has that port closed, because the request will never get there.
- ptx 8y agoAh. Sure. But if the server doesn't listen on port 80 and you document this fact, clients won't regularly attempt to connect on port 80 (since they know it can't work). I guess this applies more to non-browser client software than to people typing URLs in their browser address field, though.
- michaelt 8y agoIf it's an API, disabling HTTP reduces the risk someone will mistakenly code a client that uses HTTP, not notice their mistake, and later users of that client will get MITMed.
- raesene9 8y agoSo it depends on your client population. If you've got general browsers hitting your site, I think HTTP-->HTTPS is a reasonable trade off and stops the poor experience of a user putting your site name into the browser bar and getting told there's no site there. If you control the client population, as in this case, there's no real need to allow HTTP at all, so I'd just disable it and have HTTPS only.
- Avamander 8y agoHave your domain HSTS preloaded and every proper browser will automatically redirect without you having to.
- deleted 8y ago[deleted]
- michaelt 8y agoDoes this mean I should turn off HTTP completely? It's unlikely this will become standard practice in the near future. The reason is, if you're using any type of hosting that shares IP addresses - Cloudflare, S3, Cloudfront - then you can't close the HTTP port as it's needed for other sites hosted on the same IP. Getting your domain added to the HSTS preload list is a more conventional way of reducing HTTP traffic.