4 ms·
If you have misconfigured cookies, having your server accept port 80 or not wont matter to a non-passive man-in-the-middle. They will just accept port 80 tra
by WatchDog 8y ago
If you have misconfigured cookies, having your server accept port 80 or not wont matter to a non-passive man-in-the-middle.
They will just accept port 80 traffic and read the cookies.
- schoen 8y agoIt's clear that there's a difference between an active and a passive attacker here. Closing port 80 protects against the passive attacker, but not against the active attacker (with regard to SSL stripping, insecure submission of old forms, and cookies not flagged as secure). Both kinds of attackers are real.
- qu4z-2 8y agoI'm fairly sure you can also just get the client to request http://example.com:443/ http://example.com:443/. The cookies get sent before the server goes "Wait, what?".
- schoen 8y agoThis thread seems to agree with you: https://stackoverflow.com/questions/1612177/are-http-cookies-port-specific https://stackoverflow.com/questions/1612177/are-http-cookies... I just tested this and I was able to confirm your suggestion with Firefox, watching with a packet sniffer while connecting to my own site with http://example.com:443/ http://example.com:443/ after previously setting a cookie over https://example.com/ https://example.com/. The cookie was clearly visible in the packet log.