HTTP over TLS/ SSL: What is Really Secured?

-

HTTP over TLS/ SSL performs encryption of transferred data. However, what is really encrypted and what isn’t?

Part of the TLS/ SSL negotiation will not be secured. Everything else is securely transmitted.

  • What is in the clear/ can be derived will be the destination hostname or IP address and the port (usually 443)
  • URLs for GET/ POST/ HEAD request methods are secured
    • GET URL parameters, e.g. ?data=12345678&id=123
    • POST URL
  • All HTTP headers are secured. These include:
    • Cookies
    • Content-type/ content-length
    • Cache control
    • User-agent
    • Accept (-encoding)
  • HTTP payload is secured. This may be:
    • POST parameter
    • HTML/ XML data

Does it therefore mean that the GET URL over HTTPS is secured? You decide for yourself….

  1. As the GET URL method information is secured, any sniffer between the source and destination would not be able to “see” the URL parameters.
  2. However, the web browser would track the full GET URL (including the parameters) in the browsing history. As such, anyone having access to the web browser might be able to view the URL.
  3. Similarly, the access logs in the web server would typically store the full GET URL

Comments

Post a Comment

Popular posts from this blog

Understanding ITIL Service Management the UML way…

-
Image
I originally had a great deal of difficult reconciling the differences amongst ITIL Change Management, Incident Management, and Problem Management. Having researched on the subjects and understanding them better now, I’ve tried to put the concepts together using a UML class diagram to capture my understanding and to keep it imprinted. Similarly, I wanted to differentiate the various categories of changes (Standard, Emergency, Normal) using an easy to understand & self-explanatory manner – a UML Activity Diagram!
Read more

How to depict (Professional-Looking) Logical Network Diagrams in Astah

-
Image
I have always had to create (professional-looking) UML diagrams using Visio-like icons. You’ve got to admit that showing a bunch of boring UML boxes hardly interests anyone less technical (like anyone whose designation has the words “manager” or “director”). This is actually possible in Astah! I’ve created a template for future projects that allows me to produce logical network diagrams that look like the following: To create this diagram, you need to do the following: Assign various icons to stereotypes. I created the following for my use: Create a new UML Deployment Diagram Every element in the diagram is created as a Node The nodes are subsequently assigned the appropriate <<stereotype>>. E.g. Internet is <<internet>>, WebZone FW is <<firewall>>, Web LB is <<loadBalancer>> Ensure the “Icon Notation” is set to “Customized Icon” for each node Instead of the boring boxes, the corresponding icons automatically gets displayed!
Read more