IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement.

HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement.

HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

1471 questions
42
votes
3 answers

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives the opposite advice: Note Despite claims to the…
Question Overflow
  • 5,300
  • 6
  • 28
  • 48
39
votes
2 answers

What is the HTTP "Server" response-header field used for?

It was not until recently that I began to question the use for the Server field in the HTTP Response-Header. I did some research: RFC 2616 states: 14.38 Server The Server response-header field contains information about the software used by the…
ZnArK
  • 607
  • 1
  • 6
  • 10
23
votes
2 answers

What does Django's ALLOWED_HOSTS variable actually do?

I'm supposed to set ALLOWED_HOSTS in my Django project's configuration to the hostnames that belong to me to ... prevent an attacker from poisoning caches and password reset emails with links to malicious hosts by submitting requests with a fake…
Nick T
  • 3,432
  • 5
  • 22
  • 28
19
votes
3 answers

Meaningless http request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG This has no meaning on our site. A search on the web revealed no information, but a few other places which logged similar requests. Is…
JNF
  • 305
  • 2
  • 11
18
votes
6 answers

How to perform safe authentication via HTTP?

I have to log in on an HTTP website. There is a login form which contains inputs for username and password and as hidden inputs the sessionId. I am creating an application in which I have to access resources which just can be accessed if you are…
Richard_Papen
  • 183
  • 1
  • 1
  • 5
18
votes
3 answers

Is it possible to create a file that never completes its download process?

Is it possible to built a file from scratch that when it gets downloaded via HTTP, the download never actually completes ? I am not talking about ZIP BOMB here. Some download software allows you to download streaming events, thus the final size of…
mahen23
  • 341
  • 2
  • 5
17
votes
4 answers

What information can my ISP see when I visit a website?

For example, when I enter this URL: https://www.google.com/search?q=example or http://www.google.com/search?q=example I can see the word example that I was searching on Google. Can the ISP see this URL and so maybe register it in their logs?
Frank
  • 457
  • 1
  • 4
  • 8
16
votes
5 answers

Obfuscating HTTP Error Codes

I'm working on a REST API endpoint where we only accept requests from certain domain names. Whitelisting. A dev I'm working with recommended that we return HTTP 400 instead of HTTP 403 if the incoming IP address is not whitelisted. They said it was…
Samuel Labrador
  • 163
  • 1
  • 5
15
votes
5 answers

Strange request URI with lot of + (spaces) and "chosen nickname"

Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this…
Free Radical
  • 774
  • 5
  • 14
13
votes
4 answers

How can I identify that my page is requested by robot, but not user's browser?

How can I detect that my page is requested by robot, but not user's browser? I'm aware of basics tricks: Watch for incorrect headers or urls. For example, urls with hash or header with full url - GET www.yoursite.com/test Detect that several…
Paul Podlipensky
  • 2,847
  • 4
  • 23
  • 26
7
votes
2 answers

Exploiting HTTP redirect function via the Host header

I am testing a web application and found a redirect function which seems to be insecure. If I visit a non-existing page, then I am getting redirected to login page of application. However the redirect function can be exploited by setting custom Host…
user1880405
  • 263
  • 1
  • 4
  • 14
6
votes
6 answers

Best guidance for allowing users to connect via HTTP in case of a certificate error

I've coded my app to use https, but if a https transaction fails for any reason, I assume it's because the server isn't configured for https, and thereafter start all transactions with http. Seems like that's a vulnerability. Likewise, a script…
ddyer
  • 2,006
  • 1
  • 13
  • 20
6
votes
4 answers

How dangerous is plain HTTP?

Usually I try to tell people not to input any data on websites that are not secured with HTTPS. Given that most people are secured by Wifi access control. How bad is it really? What are possible attack scenarios? How easy is it too intercept HTTP…
Corporal Touchy
  • 837
  • 1
  • 6
  • 10
5
votes
1 answer

Is the HTTP method OPTIONS secure nowadays?

I've read How to exploit HTTP Methods: OPTIONS - this is a diagnostic method, which returns a message useful mainly for debugging and the like. This message basically reports, surprisingly, which HTTP Methods are active on the webserver. In…
angrydev
  • 53
  • 1
  • 3
4
votes
1 answer

Spoof IP in a TCP Packet & Vulnerable PHP Code

Assuming we have this PHP Script It is vulnerable? I mean let's say that I'm the 22.41.41.41. Can someone else spoof that IP by…
OhGodWhy
  • 43
  • 3
1
2 3 4