Tag Info

Hot answers tagged

5

<form action="http://example.com/"> would post data insecurely, even if the page the <form> is on is itself HTTPS. Data sent in this manner can be intercepted / MITMed. For the same reasons, <form action="https://example.com/"> on a HTTP page is sent securely. However, the page the <form> is hosted on in this situation can itself be ...


5

You should post directly to an https: URL. User agents do not resubmit the POST request if the response was a 301 or 302. And while the 307 status code can be used to indicate that the POST request should be resubmitted, most user agents do not support it.


3

This is, perhaps, a bit too obvious of a statement, but the blocking behavior has to be based on the information that the remote server is privy to. That would include: The source IP address The source TCP port, which should be ephemeral and changing on each request There's probably some passive fingerprinting of the client's IP stack that's possible The ...


2

HTTP is NOT a secure protocol, it never has been, and is not meant to be. HTTPS IS the same protocol over a secure channel, though only if you use TLS 1.0 or newer (TLS 1.2 is highly recommended as 1.0 and 1.1 have known issues).


2

Config snippet for NGINX to run as a reverse proxy http { # Some standard NGINX config stuff goes here ... # Listen on port 80 server { listen 80; server_name my.awesome.domain.com; # Proxy /jenkins to localhost port 8080 location /jenkins { proxy_pass http://localhost:8080; } # Proxy /jira to localhost port 8081 ...


2

You need a properly configured webserver capable of proxying (e.g. Apache, Nginx) listening on localhost:80).


2

As secure as going directly to HTTPS from HTTPS? No. More secure than not redirecting? Yes. The attack vector when redirecting from HTTP to HTTPS is that a MITM could modify the redirect to redirect the user to a non HTTPS version instead (aka. SSL stripping or a HTTPS downgrade attack). Navigating directly to HTTPS (or being taken there from a HTTPS page) ...


1

Before the https got place, they are simple HTTP over TCP connections. Yes, it can be snooped, but really not easily. Maybe a little bit of dns spoofing can be usable in most such cases. A naive sloop were hard, the TCP has session id which is maybe not very long, but obstacles such tries. AFAIK in such cases the dns spoofing is a viable alternative. ...


1

So, my question is - how do I put http://www.baidu.com instead of / (SLASH) in GET request? The request you want to have is not a bad one, but just a proxy request. To create it just specify your target host as a proxy. Apart from that curl might be not the right tool to generate real bad requests.


1

Limiting the access on the side of Apache is a more general approach that works for everything, including static files. It's a generally more secure approach because the request is blocked before the PHP interpreter ever sees it, making it impossible (or at least much more difficult) to exploit bugs in the PHP app. Limiting the access on the side of a PHP ...


1

Hop-by-hop only means that the proxy is free to change the header as it sees fit and interpret it immediately; the header should not be forwarded without interpretation. The default for HTTP/1.1 is persistent connections unless one of the parties on a connection (either client-to-proxy or proxy-to-server) specifies the Connection: close header. This header ...


1

Your wifi needs to be connected to a gateway where you can redirect the traffic towards your captive portal (login page). You can do this by using iptables on linux. Say that your interface eth0 is connected to your access point with the 192.168.0.0/24 subnet and your gateway (linux server) is configured at 192.168.0.1 and has internet access on a separate ...



Only top voted, non community-wiki answers of a minimum length are eligible