HTTP and HTTPS Security Basics

# CHAPTER 3

HTTP and HTTPS Security Basics #

1. Introduction #

2. Learning Objectives #

• Explain why standard HTTP is inherently insecure for APIs.

• Understand the mechanics of HTTPS and SSL/TLS encryption.

• Explain the role of Digital Certificates and Certificate Authorities (CAs).

• Understand Man-in-the-Middle (MitM) attacks.

• Configure servers and code to enforce secure communication.

3. Beginner-Friendly Explanation #

HTTPS (Hypertext Transfer Protocol Secure) is like putting that postcard inside a locked, indestructible steel briefcase. Only you have the key to lock it, and only the destination server has the key to unlock it. Even if a hacker intercepts the briefcase while it's traveling across the internet, all they see is scrambled, unbreakable math.

4. Real-World Attack Scenarios #

• Man-in-the-Middle (MitM) Attack: You are at a coffee shop. A hacker sets up a fake Wi-Fi network named "StarbucksFreeWiFi". You connect to it. Your mobile app sends an API request over HTTP to log into your bank. The hacker's laptop intercepts the request, reads your password in plain text, and then forwards the request to the bank. You never know you were hacked.

• Packet Sniffing: An attacker compromises a router at an ISP. They use packet-sniffing software (like Wireshark) to monitor all traffic. If an API uses HTTP, they can extract API keys and JWT tokens instantly.

5. Security Examples (SSL/TLS) #

1. 1. The Handshake: The client (Postman/Browser) connects to the API.

1. 2. The Certificate: The API sends back its Digital Certificate (issued by a trusted entity like Let's Encrypt), proving it is the real api.bank.com and not a hacker.

1. 3. The Keys: They mathematically agree on a temporary, unbreakable secret key.

1. 4. Encrypted Tunnel: All subsequent API requests (headers, URLs, JSON body) are encrypted using that key.

6. Vulnerable vs Secure Code Examples #

Vulnerable PHP (Allows HTTP):

<?php
// API logic runs regardless of how the data arrived
$password = $_POST[&#039;password']; 
login_user($password);
?>

Secure PHP (Forces HTTPS):

<?php
// Reject any request that is not sent via HTTPS
if (!isset($_SERVER[&#039;HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
    http_response_code(403);
    echo json_encode(["error" => "Insecure connection. Use HTTPS."]);
    exit;
}

$password = $_POST[&#039;password'];
login_user($password);
?>

7. HTTP Examples (Plaintext vs Ciphertext) #

POST /api/login HTTP/1.1
Host: api.example.com
Content-Type: application/json

{"email": "admin@site.com", "password": "super_secret_password"}

If a hacker intercepts an HTTPS request, they see:

3fa8c9b2e1d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1...
(Indecipherable encrypted garbage)

8. JSON Examples #

9. PHP Examples (Secure Cookies) #

<?php
// The 5th parameter 'true' makes the cookie "Secure" (HTTPS only)
// The 6th parameter 'true' makes it "HttpOnly" (prevents XSS)
setcookie("api_session", $token, time() + 3600, "/", "api.example.com", true, true);
?>

10. Best Practices #

• HTTPS Everywhere: There is no excuse for using HTTP in modern development. Use free services like Let's Encrypt to get SSL certificates for all your APIs.

• HSTS (HTTP Strict Transport Security): Configure your web server to send the HSTS header. This tells the browser/client, "Never, ever try to talk to me using HTTP, only use HTTPS."

• Keep TLS Updated: Ensure your server disables outdated, broken protocols like SSLv3, TLS 1.0, and TLS 1.1. Only allow TLS 1.2 and TLS 1.3.

11. Common Mistakes #

• Mixed Content: Having an HTTPS website, but the frontend JavaScript makes an API call to an http:// endpoint. Modern browsers will block this automatically, breaking your app.

• Ignoring Certificate Errors: When developing locally or using self-signed certificates, developers often tell Postman or cURL to "Ignore SSL Certificate Verification". If this flag makes it into production code, it completely defeats the purpose of HTTPS, making MitM attacks trivial.

12. Security Checklists #

• [ ] Is an SSL/TLS certificate installed and valid?

• [ ] Does the server automatically redirect all HTTP traffic to HTTPS?

• [ ] Is the PHP application actively rejecting non-HTTPS requests?

• [ ] Are all authentication tokens and passwords transmitted ONLY over HTTPS?

13. Mini Exercises #

1. 1. What does the "S" in HTTPS stand for?

1. 2. In your web browser, navigate to a major website (like google.com) and click the padlock icon next to the URL. View the Certificate to see who issued it.

14. Practice Challenges #

15. MCQs with Answers #

16. Interview Questions #

• Q: Explain how a Man-in-the-Middle attack works against an API using standard HTTP.

• Q: What is TLS, and what role does a Digital Certificate play in API security?

• Q: Explain the purpose of the Secure and HttpOnly flags when setting cookies in PHP.

17. FAQs #

18. Summary #

19. Next Chapter Recommendation #