Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our site currently redirects requests sent to http://example.com to https://example.com -- everything beyond this is served over SSL. For now, the redirect is done with an Apache rewrite rule.

Our site is dealing with money, however, so security is pretty important. Does allowing HTTP in this way pose any greater security risk than just not opening or listening on port 80? Ideally, it's a little more user-friendly to redirect.

(I am aware that SSL is only one of a large set of security considerations, so please make the generous assumption that we have done at least a "very good" job of covering various security bases.)

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You're doing the right thing by redirecting http to https (assuming you use 301 redirects).

One additional thing that you should strongly consider doing is enabling Strict Transport Security so that browsers know that this is a web site they should connect to only via https.

share|improve this answer
    
Thanks, and especially thanks for the link to HSTS, which is simple, and a great idea that I had no clue about. Yes, the redirect is a 301 :-) –  Tom Harrison Jr Sep 26 '12 at 3:37

It actually can create a security issue if done incorrectly, but given that the biggest banks and financial firms in the world [effectively] do it for their online services, I think you're safe, or at least in good company.

Stack Overflow has an older thread on the topic, and as observed, you want to make sure that you enable HSTS, otherwise there are potential issues with MiTM attacks and potential session hijacking.

And, by the way, the recommended way to do this is with a VirtualHost rule rather than mod_rewrite.

share|improve this answer
    
Thanks as much as Michael, who beat you by a few minutes ;-). Any rewriting is done within a VirtualHost container (no .htaccess). While I read Apache's exhortation to use the simpler method, for the moment, I have a couple of related rewrites (e.g. domain canonicalization) that are more logically grouped as one set. Once we move this to our app and out of Apache, I can make the evil RewriteRule a bad memory :-) –  Tom Harrison Jr Sep 26 '12 at 3:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.