4 ms·

IMO it's better to close port 80 entirely because many clients will end up sending unencrypted headers and rely on the redirect, not realizing they've exposed t

IMO it's better to close port 80 entirely because many clients will end up sending unencrypted headers and rely on the redirect, not realizing they've exposed themselves. ===> HTTP GET /your_api Host: passwordleaker.com Authorization: Bearer 12312312321 <=== HTTP/1.0 302 Found Location: https://passwordleaker.com/your_api (but note it's too late)

SahAssar 4y ago
What client are you using that sends Authorization on domains that are not configured (since then you would configure them to use https)? Also, if you are MITM:ed the MITM could still have port 80 open, so you don't actually protect against anything, right?
- maerF0x0 4y ago
  Closing 80 protects against a Mallory that has readonly access to the network between Alice and Bob. Also afaik most http request libraries in many languages would not have such a guard? eg: this code sample in go produces the raw header when I listen with nc https://go.dev/play/p/s1CaOVcGcxS https://go.dev/play/p/s1CaOVcGcxS nc -l 8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: Go-http-client/1.1 Authorization: Bearer 123123 Accept-Encoding: gzip
  - SahAssar 4y ago
    Yes, because you configured it to go to http, not https. Usually if you have credentials to send you also have a domain configured for those credentials, and then you'd configure the correct address, right?
    - maerF0x0 4y ago
      That's my whole point though. If you build an API but then its up to customers to integrate with you, you can help them avoid one of many pitfalls by not allowing them to do a dumb thing like send private headers over unencrypted channel >because you configured it to go to http, not https. Usually if you have credentials to send you also have a domain configured for those credentials, and then you'd configure the correct address, right? The "you"s in your sentence are actually 2 different actors the one doing configuring is often a not technically excellent client, the "you" who has a domain is the API creator, who can also help out the client by closing 80 or refusing non-TLS traffic on 80.
toast0 4y ago
Closing port 80 may help with passive observers, but doesn't help with MITM, because they can just accept port 80 on your behalf. If you care, you need hsts preload to prevent browsers from trying http on your domain(s).

SahAssar 4y ago

What client are you using that sends Authorization on domains that are not configured (since then you would configure them to use https)? Also, if you are MITM:ed the MITM could still have port 80 open, so you don't actually protect against anything, right?

maerF0x0 4y ago
Closing 80 protects against a Mallory that has readonly access to the network between Alice and Bob. Also afaik most http request libraries in many languages would not have such a guard? eg: this code sample in go produces the raw header when I listen with nc https://go.dev/play/p/s1CaOVcGcxS https://go.dev/play/p/s1CaOVcGcxS nc -l 8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: Go-http-client/1.1 Authorization: Bearer 123123 Accept-Encoding: gzip
- SahAssar 4y ago
  Yes, because you configured it to go to http, not https. Usually if you have credentials to send you also have a domain configured for those credentials, and then you'd configure the correct address, right?
  - maerF0x0 4y ago
    That's my whole point though. If you build an API but then its up to customers to integrate with you, you can help them avoid one of many pitfalls by not allowing them to do a dumb thing like send private headers over unencrypted channel >because you configured it to go to http, not https. Usually if you have credentials to send you also have a domain configured for those credentials, and then you'd configure the correct address, right? The "you"s in your sentence are actually 2 different actors the one doing configuring is often a not technically excellent client, the "you" who has a domain is the API creator, who can also help out the client by closing 80 or refusing non-TLS traffic on 80.

toast0 4y ago

Closing port 80 may help with passive observers, but doesn't help with MITM, because they can just accept port 80 on your behalf. If you care, you need hsts preload to prevent browsers from trying http on your domain(s).