0

After two days of searching, I decided to ask this question here:

I have extremely limited lighttpd installed on my iDevice, and I need to redirect all received https traffic to http. I don't have mod_rewrite nor do I have ssl compiled in.

I came up with this, but it doesn't seem to work:

$SERVER["socket"] == ":443" {
 $HTTP["host"] =~ ".*" {
  url.redirect = ( ".*" => "http://%1" )
 }
}

Also, for lighttpd to get the port 443 traffic, do I need to set server.port to 443, or can I just leave it = 80 in the config file?

Thanks in advance!

1 Answer 1

1

If you're not using SSL, then your version of lighttpd will be unable to respond to an incoming HTTPS request as it will be unable to decode the response (which will be SSL encrypted by the client's browser).

It will also be unable to reply over HTTPS with the Redirect reply.

You'll need to compile Lighttpd with SSL support, or put at least something in there on port 443 which can decrypt SSL (perhaps openssl with the s_server option in HTTPS mode).

5
  • I thought that the servername isn't encrypted when https is used. What I mean is: in example.com/stuffhere, example.com isn't encrypted, is visible (which you can see when doing arp and dns spoofing), while stuffhere is encrypted. Oct 17, 2011 at 17:02
  • @linkxs No, all traffic from the initiation of the HTTP request is encrypted. Clients connecting to your server with https:// in their address bar will get an error. Oct 17, 2011 at 18:21
  • Then how come arpspoof catches facebook.com? The issue is that it can't do anything with it past that point. Oct 17, 2011 at 23:37
  • Because arpspoofing catches it at a lower layer. It depends on how the attack is done (dns spoofing), but arpspoofing intercepts all traffic between the client and the gateway.
    – Trcx
    Mar 13, 2013 at 21:52
  • wow, bringing this comment back from the dead after quite a break! Anyway, there's DNS spoofing, or alternatively SNI which can be used to do this. Also, if someone happens to type "facebook.com" into a browser, even if they're redirected from the plain HTTP URL to the HTTPS one, it's possible to capture the first request and /not/ issue the HTTP->HTTPS redirect, and instead perform an MITM attack. Mar 14, 2013 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .