1

Currently I'm running a web server,

The server itself is using both HTTP "Port 80" and HTTPS "Port 443". I purchased an SSL certificate and installed it to the issue is the manufacturer of the application strongly suggest that I keep the port 80 opened to keep other applications related to running. The method suggested for protection was to install a redirect, I feel like this is not a proper way of protecting a server

My question is what would be my best option to properly secure my server and have it accessible?

Thank you!

4

Regarding attacks against the server it is no less secure having port 80 open for HTTP than having port 443 open for HTTPS. If there is a bug at the server side of the provided web application (i.e. SQL injection or similar) it can be exploited no matter if HTTP or HTTPS.

The relevant difference between HTTP and HTTPS is that HTTPS protects the transport of the data between client and server. Properly used the attacker does not get access to the transferred data, cannot modify the data and cannot impersonate the original server even if he can be a man in the middle in the connection between client and server.

To make sure that the client will make use of the protection the server either needs to offer only access to HTTPS (i.e. switch HTTP off) or make sure that the client will access the HTTPS part by using HSTS or by redirecting every HTTP request from the client to HTTPS. If the server provider can be sure that the client will always access the server by HTTPS anyway then HTTP could be switched off completely. Unfortunately for now the default protocol in browsers is still HTTP and thus an attempt to enter the simplified URL (i.e. example.com instead of https://example.com) will try to access the site with HTTP and fail with a (usually not user-friendly) error message if HTTP port is switched off. This is the main reason HTTP should be kept active, i.e. to redirect users to HTTPS.

0

You can use HTTP Strict-Transport-Security response header, which forces the client to only request https requests. For more info see this:- HSTS

  • 1
    Good point, but that still requires a server to respond on the default port for plain http , tcp port 80, to prevent an error for first time users that don't automatically use https yet – HBruijn Dec 11 '18 at 15:23
  • When this response header is present on the server then the server will respond 301 moved permanently header which means https. – janu agrawal Dec 11 '18 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.