If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too?
Why is this not a good practise? (and the preferred way is to do a 301 from the server side)
- ok SEO while a 301 is preferred for the search bots.
- disable the script in the browser, you are stuck
anything else?
For onething, according to me, a session fixation through MITM is not possible at least because all the raw response gives me is as below. There is no cookie, whatsoever.
<html>
<head><title>hussh...</title></head>
<script language="JavaScript">
function redrToHttps()
{
var httpURL= window.location.hostname + window.location.pathname + window.location.search;
var httpsURL= "https://" + httpURL;
window.location = httpsURL;
}
redrToHttps();
</script>
<body>
I do not know why a lot of tutorials on the internet advise you to do it via javascript, while a 301 permanent is a perfect choice. AFAIK, I could not find an attack vector in this form of redirect via javascript with 403 header.
Am I missing something? Are there any attack vectors that I could be up against in the future? Why is this not the recommended way?
Edit:
May be I forgot to mention why I posted this question. I have already raised a flag to use HSTS, it was missing in the website in question. My concern is, the people that developed this application followed the first link in google (back then, when they developed) to make this http to https redirection via javascript. Honestly, this is the first time I saw a http to https redirect for all pages of the application via javascript. I don't have to tell you how bad, and stupid the javascript https redirect sounds even at the outset. But I looked at raw response, there was a 403 which is fine (hey, you are forbidden), although not the best way of doing it.
The site never serves any information over http. It always uses the javascript to do the redirection make a new request. Too bad. I get it. May be your answers/thoughts about how susceptible this could be, would me help sell why this is such a bad idea in terms of security.
I am afraid that this is not a possible duplicate as no question in the stackexchange network discusses the security implication of a http to https redirect via javascript in specific. Keeping the best practices apart, I would appreciate your ideas on how insecure (and why so) this approach is.
Custom client side script instructing the browser to navigate to a different page, and the browser responding to a 301 as in http://paypal.com has fundamental differences I believe. Are they any knows exploits demonstrated in this case?
Thank you.
Edit 2: Did someone notice a 403? In IIS 6 if you had enabled require HTTPS and if you tried to access the site via HTTP and if you hadn't configured SSL properly, then that's what you would get a 403 dull error page. Old time quick fix solution is to trap a 403 in the server and return a custom error page that would contain a javascript code like i mentioned in the question. That javascript would then request the HTTPS version of the page, which is a new browser request, and not a redirect of any sort. Which is actually equivalent to a new https request. This is bad, very bad, poor implementation. But the question now is, you request a resource on http, that returns you a 403 with some java script that helps put https in the url for you and hence issuing a new https request. Not a 301/301 induced HTTPS. May be the question title says the word redirect, but now I have second thoughts about the misnomer now. To put things in perspective here is a post - http://raoulpop.com/2007/08/07/automatic-redirect-from-http-to-https/ that describes what I am saying. Very old post indeed. How is this a duplicate question?
