Consider disabling HTTPS auto redirects

Re:Consider disabling HTTPS auto redirects by maerF0x0 on Monday June 27, 2022 @11:26AM (#31895915)

IMO it's better to close port 80 entirely because many clients will end up sending unencrypted headers and rely on the redirect, not realizing they've exposed themselves.

    ===>
    HTTP GET /your_api
    Host: passwordleaker.com
    Authorization: Bearer 12312312321


    <===
    HTTP/1.0 302 Found
    Location: https://passwordleaker.com/your_api

(but note it's too late)

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by toast0 on Monday June 27, 2022 @12:03PM (#31896504)

Closing port 80 may help with passive observers, but doesn't help with MITM, because they can just accept port 80 on your behalf.

If you care, you need hsts preload to prevent browsers from trying http on your domain(s).

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by SahAssar on Monday June 27, 2022 @11:31AM (#31895991)

What client are you using that sends Authorization on domains that are not configured (since then you would configure them to use https)?

Also, if you are MITM:ed the MITM could still have port 80 open, so you don't actually protect against anything, right?

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by maerF0x0 on Monday June 27, 2022 @06:15PM (#31901572)

Closing 80 protects against a Mallory that has readonly access to the network between Alice and Bob.

Also afaik most http request libraries in many languages would not have such a guard?

eg: this code sample in go produces the raw header when I listen with nc https://go.dev/play/p/s1CaOVcGcxS

  nc -l 8080
  GET / HTTP/1.1
  Host: localhost:8080
  User-Agent: Go-http-client/1.1
  Authorization: Bearer 123123
  Accept-Encoding: gzip

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by SahAssar on Tuesday June 28, 2022 @03:25AM (#31905100)

Yes, because you configured it to go to http, not https. Usually if you have credentials to send you also have a domain configured for those credentials, and then you'd configure the correct address, right?

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by maerF0x0 on Tuesday June 28, 2022 @01:38PM (#31910653)

That's my whole point though. If you build an API but then its up to customers to integrate with you, you can help them avoid one of many pitfalls by not allowing them to do a dumb thing like send private headers over unencrypted channel

>because you configured it to go to http, not https. Usually if you have credentials to send you also have a domain configured for those credentials, and then you'd configure the correct address, right?

The "you"s in your sentence are actually 2 different actors the one doing configuring is often a not technically excellent client, the "you" who has a domain is the API creator, who can also help out the client by closing 80 or refusing non-TLS traffic on 80.

[ Parent | on HN ]