Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it acceptable to run a website which only serves on HTTPS and not HTTP. Consider situations where plain domain names are typed in address bar. Usually websites redirect the user to the HTTPS version.

There is a good reason for wanting to only provide HTTPS. Consider this scenario:

  • User is a developer using a REST API to talk to server.
  • User forgets the "s" at the end of "http" when posting potentially sensitive information.
  • POST goes on wire with its payload on a non-secure channel vulnerable to the usual eavesdropping.
  • Only after the POST is complete, does the server send a redirection code to the secure site
share|improve this question
1  
Yes, it is acceptable, and I wish more people would. –  Zoredache Feb 26 '12 at 20:15
1  
I think you're asking the wrong question. The question should be, "Is it acceptable to send an error message rather than a redirect if an API call that should be sent over a secure channel is sent over an insecure channel?" And the answer to that question is "Yes, of course". The developer needs to get a failure message if they make a mistake that can compromise security. –  David Schwartz Feb 26 '12 at 21:27

2 Answers 2

up vote 3 down vote accepted

Depends on the site.

The situation that you've outlined above can only be prevented if the server doesn't accept the connection on port 80 whatsoever; a user-friendly redirect or even an error page that says "use https!" would allow for the unencrypted API request to be sent. Of course, when it doesn't work, the person making the call should hopefully notice and fix their mistake after one failed attempt - and hopefully they aren't testing with sensitive data.

Whether or not this single non-secure communication attempt is acceptable (hopefully with non-sensitive data) depends completely on your security needs.


If the site's used for API calls only, then it's just fine to leave port 80 off.

If users will be visiting the site in a browser (entering the address manually), then don't expect to be able to leave port 80 off without confusion and annoyed users.

share|improve this answer
    
Yep, this is the ideal solution. Having the API and the WWW site on separate machines solves this problem. But due to lack of adequate resources, I have to put both on one server. –  Mansour Feb 27 '12 at 7:10
    
Can you bind a second IP address to the server, and split them up that way? –  Shane Madden Feb 27 '12 at 16:00
    
Awesome. Turns out I can do that! Thanks. –  Mansour Feb 27 '12 at 17:15

I really don't see any good reason not to. If your site has to be secure all the way, then nothing prevents you from only serving over SSL.

Here's a KB on how to do it: Apache: Redirect http to https Apache secure connection – force HTTPS Connections

To only allow SSL connections, you could also use the SSLRequireSSL directive in your server config.

(Not sure if this would be suitable for you as it would redirect ALL traffic on port 80 to port 443 for your whole server, but this could also work):

Modify your iptables to redirect port 80 to port 443:

--iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
--iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
--iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 443
share|improve this answer
    
Redirecting doesn't prevent the insecure API call that he's concerned with. –  Shane Madden Feb 26 '12 at 20:42
    
You're right, I missed that part. I've updated my question with another (better) alternative. –  Yanick Girouard Feb 26 '12 at 20:53
1  
Unfortunately, even the 403 response that SSLRequireSSL would respond with wouldn't prevent the client's request data from being sent over the wire unencrypted. –  Shane Madden Feb 26 '12 at 21:15
    
Humm... good point. If that's what he wants to prevent, then as you wrote, the only way is to not listen on port 80 at all. But as you also wrote, this won't be "garceful" for normal users trying to access the site. What about using iptables with a PREROUTING/REDIRECT rule to redirect traffic on port 80 to port 443? (Providing there are no other sites on the server of course) –  Yanick Girouard Feb 26 '12 at 21:20
    
I've updated my answer with the PREROUTING idea... –  Yanick Girouard Feb 26 '12 at 21:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.