[deleted]
API Shouldn't Redirect HTTP to HTTPS
41–50 of 310 posts
Re: API Shouldn't Redirect HTTP to HTTPS
#42The author includes a surprising response from "Provider B" to the HackerOne report. > Provider B: Reported on 2024-05-21 through their HackerOne program. Got a prompt triage response, stating that attacks requiring MITM (or physical access to a user's device) are outside the scope of the program. Sent back a response explaining that MITM or physical access was not required for sniffing. Awaiting response. I think Pr…
Definition question. I can see your reasoning and I can see the author's, where they define MITM as requiring an active component being in the middle to actually tamper with it and not just some far-off device receiving backscatter with a high-gain antenna, or a read-only mirror port on a switch or whatever is technically not "in the middle" but in a cul-de-sac. I'm not sure I've got a strong opinion, claiming one or the other is the only correct definition might just be nitpicking
They may have chosen this wording ("it's not MITM") to get the team into action rather than dismissing the risk
Edit: another legitimate-sounding question downvoted in this thread without further comment (since I'm the only comment still after it got downvoted). Can people maybe just explain what's wrong with a post when it's not a personal attack, not off topic, not answered in the article, or any other obvious downvote reason? Everyone would appreciate the author learning from the problem if there is one
Re: API Shouldn't Redirect HTTP to HTTPS
#43Sort of off-topic. What is a recommended way to sell access to a one-off data API? Low code method to control access and facilitate payment?
As in, selling API keys? Not sure what you're asking for. Are you looking for a webshop that has API key sales as a default item type or something?
Yes, more like a SaaS. Maybe a solution that is tailored to selling API access. Generates a unique URL to the user, or API key, after they sign up for the API service.
Re: API Shouldn't Redirect HTTP to HTTPS
#44Earlier quoted context omitted.
That's literally what the article suggests: > A great solution for failing fast would be to disable the API server's HTTP interface altogether and not even answer to connections attempts to port 80.
It also says > We didn't have the guts to disable the HTTP interface for that domain altogether, so we picked next best option: all unencrypted HTTP requests made under /api now return a descriptive error message along with the HTTP status code 403. So close and yet … their misconfigured clients will still be sending keys over unencrypted streams. Doh
> So close and yet … their misconfigured clients will still be sending keys over unencrypted streams. Doh
And how does disabling the HTTP interface altogether prevent that? In that case, any sensitive credentials are still already sent by the client before the server can do anything.
Re: API Shouldn't Redirect HTTP to HTTPS
#45> Servers can now send HSTS along with the initial HTTP-to-HTTPS redirection response > Node.js's built-in fetch happily and quietly followed those redirects to the HTTPS endpoint. Okay.. does nodejs fetch respect HSTS?
How would that even work? It's up to the developer to consider the response and act correctly on it.
Same way as TLS session resumption can be handled by libraries without you having to touch it, or perhaps requiring you to specify a storage file and taking it from there
Re: API Shouldn't Redirect HTTP to HTTPS
#46My personal website (darigo.su) doesn't have HTTPS. I just deployed it a few months ago and haven't really done much with it yet. I guess I'll have to get around to it eventually, but I find charm in small old sites that haven't implemented modern protocol stuff. My site also uses and tags all over the place. Maybe I'll do some more quirky anachronisms, like only serve the site via HTTP 1.0 or something. Who knows. S…
That’s fine, but rather unrelated to the article, which is about the situation that you have an API served via HTTPS, and the question of whether you should also have a redirect from HTTP to HTTPS in that case, or rather return an HTTP error.
Re: API Shouldn't Redirect HTTP to HTTPS
#47Now that I think about it, interfaces such as Js fetch should make it an error to use http without explicitly allowing in an option.
It seems to easy to make an error and end up in a situation like the post explains.
Re: API Shouldn't Redirect HTTP to HTTPS
#48Or just add your domain to the hsts preload list and never have to worry about this.
That works for browsers but I doubt any non-browser HTTP clients (e.g. curl and wget) or HTTP library (e.g. Python requests lib) will check the HSTS preload list.
In fact if they do follow HSTS headers, a simple `Strict-Transport-Security: ...; preload` would have fixed the issues mentioned in the article.
Re: API Shouldn't Redirect HTTP to HTTPS
#49Nothing should redirect ever. However, it happens.
Re: API Shouldn't Redirect HTTP to HTTPS
#50I do redirect APIs to HTTPS, but I'd prefer not to. There's a simple reason - My APIs are hosted on the same IP as the public website, behind the same load balancer, so something has to be on the HTTP port. I would prefer to separate them, and my larger customers do - But for smaller customers, it's an unnecessary added expense and complication that doesn't make sense.