4

How secure would this setup be ?

Unsecure page 'http://www.site.com' makes an XMLHttpRequest with POST to url 'https://www.site.com/dosomething.asp'

The page dosomething.asp has header 'Access-Control-Allow-Origin: http://www.site.com' set and returns some user related data that needs to be secure.

No errors, all goes well.

How secure is the actual POST request ? How secure is the responseText from this request ?

ziesemer
  • 27,712
  • 8
  • 86
  • 94
xandman
  • 131
  • 6
  • 3
    As soon as you introduce a non-SSL component to your application, you have lost all the benefits of SSL. You are only as secure as the weakest part. This is why browsers report mixed SSL/non-SSL content as a security alert to the user. – Cheekysoft Dec 19 '11 at 13:25

3 Answers3

4

The most significant issue I can see is that your unsecure page is not secure (ok, obvious). If someone were to attempt a man-in-the-middle attack on that unsecure page, they could edit the functionality of the page (using JavaScript injection, etc.) to intercept the content being sent to and received from the secure URL. You are best off to use both pages in secure mode (SSL/TLS).

ziesemer
  • 27,712
  • 8
  • 86
  • 94
  • Ok here is my idea - Maybe I'm dead wrong. Let's say unsecure page has two formfields username and password. Connection to dosomething.asp is only made over SSL and if the responseText is secure ... than wouldn't it be secure enough to meet basic privacy requirements ? – xandman Dec 17 '11 at 19:28
  • Not in an application I would develop or be responsible for. Your approach would secure the data from "prying eyes" over the network, but as I eluded to above, not securing the original page would leave open paths for someone to more easily exploit to intercept both the request and the response. Unless you have a really good reason not to, I'd strongly recommend just security both pages. This will also provided added confidence to your users, as the web browser will show as in "secure mode" when the user is actually entering their data. – ziesemer Dec 17 '11 at 19:32
  • Ok and what could one do ... to secure the most urgent issues with this setup ... if this setup can't be changed for whatever reason ? and the browser "secure mode" isn't of any importance to show to the users...in this case. – xandman Dec 17 '11 at 20:40
  • 2
    @user980261 yeah ziesemer is correct. SSL is all or nothing, you cannot have a partially secure system. – rook Dec 18 '11 at 01:29
2

As soon as you introduce a non-SSL component to your application, you have lost all the benefits of SSL. You are only as secure as the weakest part. This is why browsers report mixed SSL/non-SSL content as a security alert to the user.

Cheekysoft
  • 35,194
  • 20
  • 73
  • 86
-2

Wireshark is a program that monitors network packets traveling across a network. It's free and popular. The definitive way to answer this question would be get Wireshark, take a day to learn it, and apply it.

The filter to see traffic from the source site would be:

(ip.src == [ip address of source]) && (ip.dst == [ip address of target])

Swap ip.src and ip.dst to see what's coming back. You could actually combine both in one filter expression actually.

This would work provided that you're on the network through which the packets are traveling.

One final item: Here's a description of PKI (https/SSL/TLS): http://www.mitre.org/news/the_edge/february_01/steve.html

I Wiresharked a sort of similar situation, and verified I was sending and receiving TLS (https) traffic. But it wasn't this situation exactly so I don't want to speculate.

kermit
  • 1,621
  • 1
  • 14
  • 14
  • Not sure what you're trying to say here. The fact that such an XHR would be sent over HTTPS doesn't mean the whole setup is secure (see @ziesemer's answer). The issue is quite similar to this: http://stackoverflow.com/a/8893704/372643 – Bruno Jan 27 '12 at 00:22
  • Wireshark would allow the user to actually see whether the data was encrypted with TLS or not. Wireshark takes some getting used to but it's a very powerful tool by which to inspect the network traffic.I have an https landing page from which I send login credentials. It's all going over https. Looking at the network traffic, it's clear that the data is encrypted with TLS. Hence it is secure. – kermit Jan 27 '12 at 02:32
  • Also, I'm used to trying to make the best of suboptimal situations. Perhaps the poster could look into AES encryption: http://msdn.microsoft.com/en-us/magazine/cc164055.aspx - I've seen this used to good effect in an application requiring transmission security. – kermit Jan 27 '12 at 02:47
  • I don't think a one-off observation makes the general design secure. The fact that you'll see the TLS traffic when you try doesn't mean that it will be the case for all your users. The vulnerability here is in the way the page is served (in plain HTTP) and the fact that it could be altered by an attacker to change the link to another (possibly the attacker's own HTTP(S) website). – Bruno Jan 27 '12 at 03:30