Collaborate Disseminate
I want to enable HTTP2 for several web servers but I’m worried about the possible security implications. I think about something like:
HTTP2 implementations are maybe more error prone than mature HTTP1 implementations so fo… Continue reading What are possible security problems of enabling HTTP2?
HTTP2 is the second major version of the HTTP protocol. It changes the way HTTP is transferred "on the wire" by introducing a full binary protocol, made up of TCP connections, streams and frames, rather than simply being a plain-text… Continue reading Passive HTTP2 Client Fingerprinting – White Paper
This question already has an answer here:
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
2 answers
It is known that sensitive information should not be transmitted in GET requests as GET requests will be cached and POST should be used.
Why can’t we use POST method for all request and ignoring GET request?
What all diffi… Continue reading Why can’t we use POST method for all requests?
Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
Continue reading What are the security benefits or risks of HTTP/2?
Why do we say that an http website is not secure compared to an https website?
Imperva released a new report at Black Hat USA 2016, which documents four high-profile vulnerabilities researchers at the Imperva Defense Center found in HTTP/2, the new version of the HTTP protocol that serves as one of the main building blocks of the Worldwide Web. HTTP/2 introduces new mechanisms that effectively increase the attack surface of business critical web infrastructure which then becomes vulnerable to new types of attacks. Imperva researchers took an in-depth look at … More → Continue reading Four high-profile vulnerabilities in HTTP/2 revealed
I realise there are similar questions around this topic, however I think this is sufficiently different/focused not to be a duplicate. I hope it doesn’t sound like a soapbox piece.
HTTP/2 effectively mandates TLS, since ther… Continue reading Are there strong technical reasons for browsers mandating TLS for http2?
Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of resisting against the ‘evil’… Continue reading Why doesn’t the HTTP/2 spec require TLS?