4 ms·
> Additionally, 24.71% of these redirections contains [...] HTTP intermediate URLs. One problem I've found is that if you have a redirect from HTTP to HTTPS, t
by adrianmsmith 7y ago
> Additionally, 24.71% of these redirections contains [...] HTTP intermediate URLs.
One problem I've found is that if you have a redirect from HTTP to HTTPS, then you don't notice an extra redirect from HTTPS to HTTP (e.g. redirect from HTTPS plain domain to HTTP www, which then in the next request get upgraded from HTTP www to HTTPS www).
Combine that with the fact that it is surprisingly difficult to prevent the AWS load balancer from redirecting from HTTPS to HTTP. Literally Apache, Nginx, Tomcat, Jetty all get it wrong out of the box. I had to write this blog post to prevent myself from getting it wrong in the future: https://www.databasesandlife.com/jetty-redirect-keep-https/ https://www.databasesandlife.com/jetty-redirect-keep-https/
The particular application I discovered that on did not accept HTTP traffic, so I discovered the extra redirect. Most people don't.
- TazeTSchnitzel 7y agoThere is thankfully HSTS and upgrade-insecure-requests, but they shouldn't be needed here…
- Avamander 7y ago> Literally Apache, Nginx, Tomcat, Jetty all get it wrong out of the box. Absolutely correct, it's surprisingly difficult to get a really good working configuration with no weird fallbacks or side effects and have working http2. I have five server blocks per domain name when using nginx, some are reusable though, here: * Port 80 with wrong domain - close connection, nothing legit does this * Port 80 with right (www. and .) domain - redirect to https:// https:// * Port 443 with no SNI - close connection, nothing legit does this * Port 443 with www. SNI (http2 enabled) - redirect * Port 443 with . SNI (http2 enabled) - display proper page Not surprisingly it tremendously cut down the amount of exploit scanners and bad bots from logs (they seem to rely on everyone not enforcing SNI) and managed to hide the server from Shodan :D. This is of course not to diss nginx, other servers e.g. caddy and apache were worse or even impossible to configure to the same point.
- zamadatix 7y agoIf you're just going to redirect www to . why not make it a CNAME instead of a hop?
- Avamander 7y agoCNAME would just resolve `www.` as `.`. Browsers and search engines would still need to be instructed to use the non www. address.
- simcop2387 7y agoCNAME in this case makes no difference vs an A/AAAA record. The HTTP side of things doesn't care what kind of DNS record it was, but will be affected by what the fqdn is, since it will affect cookie propagation and other security things in the browser.
- toast0 7y agoIt's usually better not to have the same content at two urls. Whichever one you choose, the other should redirect to; or if you're picky like me, trying to go to the non-published one should send you to the home page on the other --- this reduces the tendency of others to link to the wrong form.
- mholt 7y ago> other servers e.g. caddy and apache were worse or even impossible to configure to the same point. Hm? What about TLS is difficult with Caddy?
- Avamander 7y agoNothing about TLS, a lot about getting the same setup as I can with nginx. E.g. getting rid of the behaviour of random TLS certificate from random block being served when no SNI matches (wtf?) and closing the connection instead.
- mholt 7y agoHmm, are you using the latest versions of Caddy? That definitely shouldn't be the case. If you are, please file a bug report! If you aren't, please upgrade. :)
- newman314 7y agoWhat does the server block for 443 with no SNI look like? I wasn't aware that one could test for the existence of SNI in the server block.
- Avamander 7y agoserver { listen {replace_with_some_ip} ssl; listen {replace_with_some_ipv6} ssl; ssl_certificate /etc/ssl/snakeoil.pem; ssl_certificate_key /etc/ssl/snakeoil.key; server_name _ {replace_with_some_ip} {replace_with_some_ipv6}; return 444; } Should catch all TLS connections that have no SNI or try to connect straight with just IP and if snakeoil is generated right then it doesn't instantly reveal what's the real hostname.