With HTTP/HTTPS communication, which combinations are actually safe?












0















Let's just make up an example - we are sending and/or receiving a secret value in HTTP header. Let's call it X-Secret: I wear diapers.



Now, I'm curious which ways the value is actually encrypted. We have 8 possible combinations:




  1. HTTP sends X-Secret to HTTP in a request

  2. HTTP sends X-Secret to HTTPS in a request

  3. HTTPS sends X-Secret to HTTP in a request

  4. HTTPS sends X-Secret to HTTPS in a request

  5. HTTP receives X-Secret from HTTP in a response

  6. HTTP receives X-Secret from HTTPS in a response

  7. HTTPS receives X-Secret from HTTP in a response

  8. HTTPS receives X-Secret from HTTPS in a response


Which combinations will have X-Secret value encrypted and safe?










share|improve this question























  • You can't mix HTTP and HTTPS in a single request/response pair.

    – Julian Reschke
    Nov 24 '18 at 14:11











  • I don’t think that’s true. You can make requests to HTTPS from your HTTP website just fine. The other way around is blocked by browsers, isn’t it? But not sure about other clients.

    – Robo Robok
    Nov 24 '18 at 14:17











  • If it wasn’t true, Facebook login API etc. would only work for HTTPS websites and it’s not the case.

    – Robo Robok
    Nov 24 '18 at 14:18













  • But when an HTML page loaded over HTTP makes an HTTPS request it's still HTTPS to HTTPS.

    – Julian Reschke
    Nov 24 '18 at 14:24











  • This is my question. Can you say which values are safe and which are not?

    – Robo Robok
    Nov 24 '18 at 14:28
















0















Let's just make up an example - we are sending and/or receiving a secret value in HTTP header. Let's call it X-Secret: I wear diapers.



Now, I'm curious which ways the value is actually encrypted. We have 8 possible combinations:




  1. HTTP sends X-Secret to HTTP in a request

  2. HTTP sends X-Secret to HTTPS in a request

  3. HTTPS sends X-Secret to HTTP in a request

  4. HTTPS sends X-Secret to HTTPS in a request

  5. HTTP receives X-Secret from HTTP in a response

  6. HTTP receives X-Secret from HTTPS in a response

  7. HTTPS receives X-Secret from HTTP in a response

  8. HTTPS receives X-Secret from HTTPS in a response


Which combinations will have X-Secret value encrypted and safe?










share|improve this question























  • You can't mix HTTP and HTTPS in a single request/response pair.

    – Julian Reschke
    Nov 24 '18 at 14:11











  • I don’t think that’s true. You can make requests to HTTPS from your HTTP website just fine. The other way around is blocked by browsers, isn’t it? But not sure about other clients.

    – Robo Robok
    Nov 24 '18 at 14:17











  • If it wasn’t true, Facebook login API etc. would only work for HTTPS websites and it’s not the case.

    – Robo Robok
    Nov 24 '18 at 14:18













  • But when an HTML page loaded over HTTP makes an HTTPS request it's still HTTPS to HTTPS.

    – Julian Reschke
    Nov 24 '18 at 14:24











  • This is my question. Can you say which values are safe and which are not?

    – Robo Robok
    Nov 24 '18 at 14:28














0












0








0








Let's just make up an example - we are sending and/or receiving a secret value in HTTP header. Let's call it X-Secret: I wear diapers.



Now, I'm curious which ways the value is actually encrypted. We have 8 possible combinations:




  1. HTTP sends X-Secret to HTTP in a request

  2. HTTP sends X-Secret to HTTPS in a request

  3. HTTPS sends X-Secret to HTTP in a request

  4. HTTPS sends X-Secret to HTTPS in a request

  5. HTTP receives X-Secret from HTTP in a response

  6. HTTP receives X-Secret from HTTPS in a response

  7. HTTPS receives X-Secret from HTTP in a response

  8. HTTPS receives X-Secret from HTTPS in a response


Which combinations will have X-Secret value encrypted and safe?










share|improve this question














Let's just make up an example - we are sending and/or receiving a secret value in HTTP header. Let's call it X-Secret: I wear diapers.



Now, I'm curious which ways the value is actually encrypted. We have 8 possible combinations:




  1. HTTP sends X-Secret to HTTP in a request

  2. HTTP sends X-Secret to HTTPS in a request

  3. HTTPS sends X-Secret to HTTP in a request

  4. HTTPS sends X-Secret to HTTPS in a request

  5. HTTP receives X-Secret from HTTP in a response

  6. HTTP receives X-Secret from HTTPS in a response

  7. HTTPS receives X-Secret from HTTP in a response

  8. HTTPS receives X-Secret from HTTPS in a response


Which combinations will have X-Secret value encrypted and safe?







http encryption https






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Nov 24 '18 at 12:54









Robo RobokRobo Robok

4,61853257




4,61853257













  • You can't mix HTTP and HTTPS in a single request/response pair.

    – Julian Reschke
    Nov 24 '18 at 14:11











  • I don’t think that’s true. You can make requests to HTTPS from your HTTP website just fine. The other way around is blocked by browsers, isn’t it? But not sure about other clients.

    – Robo Robok
    Nov 24 '18 at 14:17











  • If it wasn’t true, Facebook login API etc. would only work for HTTPS websites and it’s not the case.

    – Robo Robok
    Nov 24 '18 at 14:18













  • But when an HTML page loaded over HTTP makes an HTTPS request it's still HTTPS to HTTPS.

    – Julian Reschke
    Nov 24 '18 at 14:24











  • This is my question. Can you say which values are safe and which are not?

    – Robo Robok
    Nov 24 '18 at 14:28



















  • You can't mix HTTP and HTTPS in a single request/response pair.

    – Julian Reschke
    Nov 24 '18 at 14:11











  • I don’t think that’s true. You can make requests to HTTPS from your HTTP website just fine. The other way around is blocked by browsers, isn’t it? But not sure about other clients.

    – Robo Robok
    Nov 24 '18 at 14:17











  • If it wasn’t true, Facebook login API etc. would only work for HTTPS websites and it’s not the case.

    – Robo Robok
    Nov 24 '18 at 14:18













  • But when an HTML page loaded over HTTP makes an HTTPS request it's still HTTPS to HTTPS.

    – Julian Reschke
    Nov 24 '18 at 14:24











  • This is my question. Can you say which values are safe and which are not?

    – Robo Robok
    Nov 24 '18 at 14:28

















You can't mix HTTP and HTTPS in a single request/response pair.

– Julian Reschke
Nov 24 '18 at 14:11





You can't mix HTTP and HTTPS in a single request/response pair.

– Julian Reschke
Nov 24 '18 at 14:11













I don’t think that’s true. You can make requests to HTTPS from your HTTP website just fine. The other way around is blocked by browsers, isn’t it? But not sure about other clients.

– Robo Robok
Nov 24 '18 at 14:17





I don’t think that’s true. You can make requests to HTTPS from your HTTP website just fine. The other way around is blocked by browsers, isn’t it? But not sure about other clients.

– Robo Robok
Nov 24 '18 at 14:17













If it wasn’t true, Facebook login API etc. would only work for HTTPS websites and it’s not the case.

– Robo Robok
Nov 24 '18 at 14:18







If it wasn’t true, Facebook login API etc. would only work for HTTPS websites and it’s not the case.

– Robo Robok
Nov 24 '18 at 14:18















But when an HTML page loaded over HTTP makes an HTTPS request it's still HTTPS to HTTPS.

– Julian Reschke
Nov 24 '18 at 14:24





But when an HTML page loaded over HTTP makes an HTTPS request it's still HTTPS to HTTPS.

– Julian Reschke
Nov 24 '18 at 14:24













This is my question. Can you say which values are safe and which are not?

– Robo Robok
Nov 24 '18 at 14:28





This is my question. Can you say which values are safe and which are not?

– Robo Robok
Nov 24 '18 at 14:28












0






active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53458362%2fwith-http-https-communication-which-combinations-are-actually-safe%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53458362%2fwith-http-https-communication-which-combinations-are-actually-safe%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

A CLEAN and SIMPLE way to add appendices to Table of Contents and bookmarks

Calculate evaluation metrics using cross_val_predict sklearn

Insert data from modal to MySQL (multiple modal on website)