4

Is it acceptable to run a website which only serves on HTTPS and not HTTP. Consider situations where plain domain names are typed in address bar. Usually websites redirect the user to the HTTPS version.

There is a good reason for wanting to only provide HTTPS. Consider this scenario:

  • User is a developer using a REST API to talk to server.
  • User forgets the "s" at the end of "http" when posting potentially sensitive information.
  • POST goes on wire with its payload on a non-secure channel vulnerable to the usual eavesdropping.
  • Only after the POST is complete, does the server send a redirection code to the secure site
2
  • 1
    Yes, it is acceptable, and I wish more people would.
    – Zoredache
    Feb 26, 2012 at 20:15
  • 1
    I think you're asking the wrong question. The question should be, "Is it acceptable to send an error message rather than a redirect if an API call that should be sent over a secure channel is sent over an insecure channel?" And the answer to that question is "Yes, of course". The developer needs to get a failure message if they make a mistake that can compromise security. Feb 26, 2012 at 21:27

2 Answers 2

3

Depends on the site.

The situation that you've outlined above can only be prevented if the server doesn't accept the connection on port 80 whatsoever; a user-friendly redirect or even an error page that says "use https!" would allow for the unencrypted API request to be sent. Of course, when it doesn't work, the person making the call should hopefully notice and fix their mistake after one failed attempt - and hopefully they aren't testing with sensitive data.

Whether or not this single non-secure communication attempt is acceptable (hopefully with non-sensitive data) depends completely on your security needs.


If the site's used for API calls only, then it's just fine to leave port 80 off.

If users will be visiting the site in a browser (entering the address manually), then don't expect to be able to leave port 80 off without confusion and annoyed users.

2
  • Yep, this is the ideal solution. Having the API and the WWW site on separate machines solves this problem. But due to lack of adequate resources, I have to put both on one server.
    – Mansour
    Feb 27, 2012 at 7:10
  • Can you bind a second IP address to the server, and split them up that way? Feb 27, 2012 at 16:00
2

I really don't see any good reason not to. If your site has to be secure all the way, then nothing prevents you from only serving over SSL.

Here's a KB on how to do it: Apache: Redirect http to https Apache secure connection – force HTTPS Connections

To only allow SSL connections, you could also use the SSLRequireSSL directive in your server config.

(Not sure if this would be suitable for you as it would redirect ALL traffic on port 80 to port 443 for your whole server, but this could also work):

Modify your iptables to redirect port 80 to port 443:

--iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
--iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
--iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 443
7
  • Redirecting doesn't prevent the insecure API call that he's concerned with. Feb 26, 2012 at 20:42
  • You're right, I missed that part. I've updated my question with another (better) alternative. Feb 26, 2012 at 20:53
  • 1
    Unfortunately, even the 403 response that SSLRequireSSL would respond with wouldn't prevent the client's request data from being sent over the wire unencrypted. Feb 26, 2012 at 21:15
  • Humm... good point. If that's what he wants to prevent, then as you wrote, the only way is to not listen on port 80 at all. But as you also wrote, this won't be "garceful" for normal users trying to access the site. What about using iptables with a PREROUTING/REDIRECT rule to redirect traffic on port 80 to port 443? (Providing there are no other sites on the server of course) Feb 26, 2012 at 21:20
  • I've updated my answer with the PREROUTING idea... Feb 26, 2012 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .