3 ms·

>any credentials sent over HTTPS are transmitted in plain text Hummmm. So a couple of years back, I was working on some internal tools that passed sensitive in

>any credentials sent over HTTPS are transmitted in plain text Hummmm. So a couple of years back, I was working on some internal tools that passed sensitive information around and I found some interesting info. Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted Also, some cloud providers aload Balancers (AWS) allow you to offer load HTTPS encryption/decryption - so there REALLY IS plain text stuff in the final leg of the journey (e.g. from the LB to the server) In the end, the biggest thing I learned is that HTTPS is hard and it sucks.

Hackbraten 5y ago
> Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted It’s still good practice to keep sensitive info out of URL query parameters, which often leak into server logs.
- detaro 5y ago
  And are (were, maybe modern browsers fixed that by now?) sent in HTTP Referers to linked sites, end up in browser history, ...
  - missblit 5y ago
    The current default for the Referer header is to send the complete referrer for same-origin requests, to send the origin for cross-origin requests, and to send nothing if going from HTTPS to HTTP. This is customizable by setting the referrer policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
deergomoo 5y ago
> Also, some cloud providers aload Balancers (AWS) allow you to offer load HTTPS encryption/decryption - so there REALLY IS plain text stuff in the final leg of the journey At first I thought this must have been what they meant; perhaps there was some configuration thing we got wrong. So we asked for clarification and nope, the example given was that someone logging in from an office could have their credentials sniffed freely by anyone else on the office LAN.

Hackbraten 5y ago

> Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted It’s still good practice to keep sensitive info out of URL query parameters, which often leak into server logs.

detaro 5y ago
And are (were, maybe modern browsers fixed that by now?) sent in HTTP Referers to linked sites, end up in browser history, ...
- missblit 5y ago
  The current default for the Referer header is to send the complete referrer for same-origin requests, to send the origin for cross-origin requests, and to send nothing if going from HTTPS to HTTP. This is customizable by setting the referrer policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

deergomoo 5y ago

> Also, some cloud providers aload Balancers (AWS) allow you to offer load HTTPS encryption/decryption - so there REALLY IS plain text stuff in the final leg of the journey At first I thought this must have been what they meant; perhaps there was some configuration thing we got wrong. So we asked for clarification and nope, the example given was that someone logging in from an office could have their credentials sniffed freely by anyone else on the office LAN.