HTTP Protocols

HTTP Protocols

HTTP (Hypertext Transfer Protocol) is the underlying communication protocol of World Wide Web. HTTP functions as a request–response protocol in the client–server computing model.

HTTP has four versions — HTTP/0.9, HTTP/1.0, HTTP/1.1, and HTTP/2.0. The common version in use is HTTP/1.1 and the future will be HTTP/2.0.

HTTP/0.9 — The One-line Protocol

• It is initial version of HTTP, a simple client-server, request-response, telenet-friendly protocol
• Request nature is single-line (method + path for requested document)
• Methods supported by this version is GET only
• Response type is hypertext only
• Connection  is terminated immediately after the response
• No HTTP headers (cannot transfer other content type files), No status/error codes, No URLs, No versioning

HTTP/1.0 — Building extensibility

• Browser-friendly protocol
• Provided header fields including rich metadata about both request and response (HTTP version number, status code, content type)
• Response is not limited to hypertext (Content-Type header provided ability to transmit files other than plain HTML files — e.g. scripts, stylesheets, media)
• Methods supported are GET , HEAD , POST
• Connection is terminated immediately after the response

HTTP/1.1 — The standardized protocol

• This is the HTTP version currently in common use.
• Introduced critical performance optimizations and feature enhancements — persistent and pipelined connections, chunked transfers, compression/decompression, content negotiations, virtual hosting (a server with a single IP Address hosting multiple domains), faster response and great bandwidth savings by adding cache support.
• Methods supported are GET , HEAD , POST , PUT , DELETE , TRACE , OPTIONS
• Connection is long-lived

HTTP/2.0

With Upgrade header introduced in HTTP/1.1, it is possible to start a connection using a commonly-used protocol, such as HTTP/1.1, then request that the connection switch to an enhanced protocol type like HTTP/2.0 or WebSockets.

HTTPS

Hyper Text Transfer Protocol Secure (HTTPS) is the secure version of HTTP. It uses SSL/TLS for secure encrypted communications.

An HTTPS connection can protect the data transfer from the man-in-the-middle attacks and common security threats by providing bidirectional encryption for communications between a client and server.

Although HTTPS is secure by its design, the SSL/TLS handshake process consumes a significant time before establishing an HTTPS connection. It normally costs 1–2 seconds and drastically slows down the startup performance of a website.

 

 

HTTP Vs HTTPS

HTTP offers set of rules and standards which govern how any information can be transmitted on the World Wide Web.

HTTP provides standard rules for web browsers & servers to communicate.

HTTP is an application layer network protocol which is built on top of TCP.

HTTP uses Hypertext structured text which establishes the logical link between nodes containing text. It is also known as “stateless protocol” as each command is executed separately, without using reference of previous run command.

HTTPS stands for Hyper Text Transfer Protocol Secure. It is highly advanced and secure version of HTTP.

HTTPS allows the secure transactions by encrypting the entire communication with SSL. It is a combination of SSL/TLS protocol and HTTP. It provides encrypted and secure identification of a network server.

Difference between HTTP and HTTPS are:

	HTTP	HTTPS
Protocol	It is hypertext transfer protocol.	It is hypertext transfer protocol with secure.
Security	It is less secure as the data can be vulnerable to hackers.	It is designed to prevent hackers from accessing critical information. It is secure against such attacks.
Port	It uses port 80 by default	It was use port 443 by default.
Starts with	HTTP URLs begin with http://	HTTPs URLs begin with https://
Used for	It’s a good fit for websites designed for information consumption like blogs.	If the website needs to collect the private information such as credit card number, then it is a more secure protocol.
Scrambling	HTTP does not scramble the data to be transmitted. That’s why there is a higher chance that transmitted information is available to hackers.	HTTPS scrambles the data before transmission. At the receiver end, it descrambles to recover the original data. Therefore, the transmitted information is secure which can’t be hacked.
Protocol	It operates at TCP/IP level.	HTTPS does not have any separate protocol. It operates using HTTP but uses encrypted TLS/SSL connection.
Domain Name Validation	HTTP website do not need SSL(Secure Socket Layer).	HTTPS requires SSL certificate.
Data encryption	HTTP website doesn’t use encryption.	HTTPS websites use data encryption.
Search Ranking	HTTP does not improve search rankings.	HTTPS helps to improve search ranking.
Speed	Fast	Slower than HTTP
Vulnerability	Vulnerable to hackers	It Is highly secure as the data is encrypted before it is seen across a network.

 

HTTP – Security

HTTP stands for Hypertext Transfer Protocol, and it is a protocol – or a prescribed order and syntax for presenting information – used for transferring data over a network. Most information that is sent over the Internet, including website content and API calls, uses the HTTP protocol. There are two main kinds of HTTP messages: requests and responses.

HTTP requests are generated by a user's browser as the user interacts with web properties. These HTTP requests all go to either an origin server or a proxy caching server, and that server will generate an HTTP response. HTTP responses are answers to HTTP requests.

HTTP is used for communications over the internet, so application developers, information providers, and users should be aware of the security limitations in HTTP/1.1.

Suggestions for reducing security risks are:

Personal information

Users must be very careful to prevent unintentional leakage of information via the HTTP protocol to other sources.

HTTP cannot regulate the content of data that is transferred. HTTP cannot have any prior method to determine the sensitivity of any particular part of the information within the context of any request.

All the confidential information should be stored at the server in encrypted form.

Authors of services that use the HTTP protocol should not use GET based forms for the submission of sensitive data, because it will cause the data to be encoded in the Request-URI (Uniform resource identifier).

File and Path Names Based Attack

The documents returned by HTTP requests should be restricted to be only those that were intended by the server administrators.

An HTTP server MUST disallow any such construct in the Request-URI, if it would otherwise allow access to a resource outside those intended to be accessible via the HTTP server.

DNS Spoofing

Clients using HTTP depend heavily on the Domain Name Service, and are thus generally prone to security attacks based on the deliberate mis-association of IP addresses and DNS names.

Clients need to be cautious in assuming the continuing validity of an IP number/DNS name association.

If the clients of HTTP cache the results of hostname lookups to improve the performance, they must observe the TTL information, which was reported by the DNS. When the IP address of the previously accessed server is changed, then the HTTP clients could be spoofed if they do not observe this rule.

Authentication Credentials and Idle Clients

Existing HTTP clients and user agents typically retain authentication information indefinitely. HTTP/1.1 does not provide a method for a server to direct clients to discard these cached credentials which are a big security risk.

It is recommended to make the use of password protection in screen savers, idle time-outs, and other methods that mitigate the security problems inherent in this problem.

Proxies and Caching

Proxies have access to security-related information, personal information about individual users and organizations, and proprietary information belonging to users and content providers. Proxy systems should be protected as they contains or transports sensitive information.

Caching proxies provide additional potential vulnerabilities, since the contents of the cache represent an attractive target for malicious exploitation. Therefore, cache contents should be protected as sensitive information.