Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [https]

Hypertext Transfer Protocol Secure (HTTPS) is a secure HTTP over SSL/TLS protocol to secure communication over a network.

0
votes
1answer
80 views

Secure Admin-pages-only login without HTTPS

I'm adding admin dashboard to a website that doesn't use HTTPS. For now only that (admin) section requires user authentication. If I use encrypted + salted password and check the client IP address to ...
1
vote
3answers
39 views

Push Notifications : FCM : Https Issue

As per the documentation at https://firebase.google.com/docs/cloud-messaging/js/client, The FCM SDK is supported only in pages served over HTTPS. This is due to its use of service workers, which ...
-1
votes
1answer
180 views

Why not put TLS certificate in DNS responses?

The security of a TLS connection relies on trusting the CA's certificate, which in turn, is usually actually a proof of DNS entry ownership. Even though the server operator may request a certificate ...
5
votes
1answer
152 views

How to configure HTTPS for deployments without a host name

I currently am in charge of networked linux based hardware that exposes HTTP connections. I want to be able to connect to these through HTTPS, but the hardware deployment has 1000's of installations. ...
-1
votes
1answer
131 views

How are some websites utilizing .JSON protocols as their web address

https://www.toyota.de/automobile/corolla/index.json I understand how .JSON works but, how is it possible to use that instead of say, .php or .html this is the first time I've seen anything like that.
3
votes
1answer
114 views

Securing an HTTPS endpoint for non-browser Post requests

I have a set of machines that I'm going to setup to push data to my web server over HTTPS at regular intervals. These units will automatically send requests using a script, so I plan on giving them ...
1
vote
2answers
489 views

How to “proxify” HTTPS request/response

I hope this question isn't considered to "open-ended"... The company that I work for is concerned about their image and they would like to have more control about the publications into their official ...
1
vote
1answer
2k views

HTTPS site perform ajax calls to native http desktop aplication

I'm working on web app that communicates with a locally installed desktop application to get certificate information from the user machine and perform digital signatures. Currently it's possible to ...
0
votes
2answers
124 views

Should my public webservices use HTTP or HTTPS?

The situation is a bit more complex than the title suggests (but not much). I'm working on a REST API that will have a few open / publicly available resources and a few with authentication. (The ...
4
votes
1answer
722 views

Is HTTP 426 acceptable for “Your request should have been HTTPS”

I have an HTTP serving an API which works either anonymously or with a secret key in a header, like so: GET /profile?authenticationKey Authorization: 1234567890 I want to reject any request coming ...
92
votes
3answers
49k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
19
votes
5answers
19k views

OAuth2 ROPC vs Basic Auth for public REST APIs?

The specific use case I'm interested in here is authenticating REST clients against publicly-available server endpoints (such as a public REST API). The simplest solution here is Basic Auth. But I ...
2
votes
1answer
87 views

Does HTTPS prevents man in the middle sending the same message several times [duplicate]

If a User is exchanging messages with a Server over HTTPS, could a man in the middle intercept messages and send them several time. For instance, George orders a laptop on a https e-commerce, could ...
-1
votes
2answers
449 views

In C is it possible to change http requests to https [closed]

Long story short I've got this package that currently has a security risk where credentials are sent over http and I need to convert them to https but I currently lack the knowledge to do so. Could ...
0
votes
1answer
94 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
3
votes
1answer
22k views

Two way Communication between Server and Clients

Situation: We have a web application running on a server. This application needs to fetch data from some other PC(Clients), which are on a different network. On the clients' pc there are WCF hosted ...
0
votes
2answers
89 views

How ensure secure two cloud services can only talk to each other?

Question Given two cloud services, Sender A & Receiver B, communicating over HTTPS, what options do I have to ensure that Receiver B only response to Sender A? For the purposes of Background ...
4
votes
2answers
281 views

Do logged in users need to browse a site over https?

I've never thought it was necessary, but a client has requested that all webpages served to logged in users be delivered over HTTPS. Aside from the implementation standpoint, which I don't think I'm ...
3
votes
3answers
130 views

Is a predefined key enough security when performing HTTP requests between two secure servers?

I have an AdWords script that regularly transfers sensitive data to my server using a POST HTTP request. For security I have a predefined 32 character randomized string that is verified by my server ...
3
votes
2answers
2k views

Committing https certificates to Github…is there ever a good reason for this?

If a server certificate is published to Github, a la: -----BEGIN CERTIFICATE----- is that necessarily a bad thing? Is there ever a legitimate reason to do this? I ask because of a recent wave of ...
11
votes
7answers
4k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
8
votes
2answers
4k views

Is HTTPS enough to avoid replay attacks?

I am exposing a few REST methods on a server for an mobile app. I would like to avoid that users can sniff how HTTP methods are built (from the mobile app) and then send them again to the server. ...
0
votes
1answer
103 views

ssl requirement -is this just initial handshaking so that subsequent socket communication can commence as normal

I am new to SSL/HTTPS so uncertain on the basics. PROBLEM: A Java applet must communicate with a socket server listening on a port on the web server. Also communication must be secure. Without SSL, ...
2
votes
1answer
93 views

Random number for HTTPS MAC

Recently I found that Netscape used quite simple algorithm to generate random number for Message Authentication Code to establish an HTTPS connection (Nestscpe used time, process identification number,...