CODEWITHSUNDEEP
ajaxsecurityhttpsjsonp
electric_al
electric_al

Reputation: 21

HTTP site with JSONP API over HTTPS?

Given all the coverage FireSheep has been getting, I have been trying to work out the best practices for balancing HTTP / HTTPS usage for some sites I manage (e.g. blogging sites, magazine sites with user contributed comments).

To me, its over kill to deliver all pages over HTTPS if the user is logged in. If a page is public (e.g. a blog) there is little point encrypting the public page. All I want to do is prevent session hijacking by sniffing cookies over HTTP channels.

So, one plan is:

This means that all 'changing' requests must be issued over HTTPS.

We use a lot of AJAX. Indeed, many comment forms use AJAX to post the content.

Obviously, I cant use AJAX directly to post content to a HTTPS backend from a HTTP frontend.

My question is: Can I use script injection (I think this is commonly called 'JSONP'?) to access the API? So in this case there would be a HTTP public page that sends data to the private backend by injecting a script accessed via HTTPS (so that the private cookie is visible in the request).

Can you have HTTPS content inside a HTTP page? I know you get warnings the other way around, but I figure that HTTPS inside HTTP is not a security breach.

Would that work? It seems to work in chrome and FF, but its IE that would be the party pooper!

Upvotes: 2

Views: 3764

Answers (2)

Sudhee G
Sudhee G

Reputation: 31

Another way is to have an iframe which points to a https page that can make all kinds (GET, POST, PUT etc) of Ajax calls to the server over https (same domain as iframe is on https too). Once the response is back inside the iframe, you can post a message back to the main window using HTML5 postMessage API.

Pseudo code:
    <iframe src="https://<hostname>/sslProxy">
    sslProxy:
        MakeAjaxyCall('GET', 'https://<hostname>/endpoint', function (response) {
            top.postMessage(response, domain);
        });

This works in all modern browsers except IE <= 7 for which you'll have to either resort to JSONP or cross domain communication using Flash.

Upvotes: 1

adamJLev
adamJLev

Reputation: 14031

The problem with JSONP is that you can only use it for GETs.

Can you have HTTPS content inside a HTTP page? I know you get warnings the other way around, but I figure that HTTPS inside HTTP is not a security breach.breach.

Including HTTPS content inside a regular HTTP page won't raise any alerts in any browser. However, I don't think JSONP will help you out of this one. Using GETs to post content and modify data is a very bad idea, and prone to other attacks like CSFR

Upvotes: 0

Related Questions