API Shouldn't Redirect HTTP to HTTPS

Re:API Shouldn't Redirect HTTP to HTTPS by jkrejcha on Tuesday May 28, 2024 @06:56PM (#40506473)

> Additionally, you have now leaked information related to the traffic of your users. Even if the request is just vanilla HTTP-only, an adversary can see that your users from one region are interested in the weather and can start building a map of that traffic.

One thing to note is that nothing about HTTPS protects against this type of attack. Assuming your API doesn't have much else going on (most services, probably), an adversary can easily see that you visited mycoolweatherapi.example regardless of if HTTPS is being used or not.

What TLS protects is higher on the network layer cake

[ Parent | on HN ]

Re:API Shouldn't Redirect HTTP to HTTPS by ric2b on Monday June 03, 2024 @06:16AM (#40561150)

Unless you're talking about DNS snooping, no, you can't see which hostname an HTTPS request is for.

If the IP address is only used to serve one website, sure, you can still see that, but that is very commonly not the case, especially for smaller websites that are likely to use shared hosting.

[ Parent | on HN ]