Questions tagged [http-proxy]
138 questions
47
votes
3 answers
How can a website find my real IP address while I'm behind a proxy?
I just wonder how some website like WhatIsMyIP find out what your real IP address is, even if you use proxy server. It said :
Proxy Detected
and then they give your real IP address.
Is it possible they use JavaScript to send HTTP request for not…
user13934
31
votes
3 answers
Authenticating a Proxy server over HTTPS
When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc.
If your browser is configured to use a web…
![](../../users/profiles/33.webp)
AviD
- 72,138
- 22
- 136
- 218
22
votes
6 answers
Securing web applications with only a reverse proxy
In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to internal web services for processing.
The idea is that…
![](../../users/profiles/79796.webp)
Michael Técourt
- 293
- 2
- 12
14
votes
1 answer
HTTP Caching Headers: private vs no-cache
We're currently reviewing our set of "no-cache" security headers:
Cache-Control "no-cache, no-store, must-revalidate
Pragma "no-cache"
Expires 0
Besides the "standard" set above, I found this article, recommending to combine "no-cache" and…
![](../../users/profiles/49495.webp)
Th0mas
- 171
- 1
- 5
14
votes
4 answers
How do proxy servers sniff data?
I live in a country which most website on the internet is blocked by government so we mostly use wide variety of proxies such Web proxies, VPN, SOCKS and most of them are free.
My question is: Is there any way, those proxy servers sniff our data…
user13934
13
votes
2 answers
Would a reverse-proxy authentication server be a secure setup?
I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would like to support OAuth login from the various…
![](../../users/profiles/170597.webp)
illabout
- 233
- 1
- 2
- 5
12
votes
2 answers
httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?
There's a new fancy-named, branded vulnerability called HTTPOXY.
My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)?
EDIT: Added image to clarify the threat and the…
![](../../users/profiles/32976.webp)
boleslaw.smialy
- 1,627
- 2
- 15
- 25
10
votes
1 answer
Is basic HTTP proxy authentication secure?
I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered acceptable.
Is proxy authentication different than…
![](../../users/profiles/182291.webp)
William Rosenbloom
- 1,516
- 2
- 6
- 12
10
votes
2 answers
How does mobile free internet bypass works? (UBT / FBT)
I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT).
The process to get it work and receive free internet seems to be as follows:
Guidance videos on YouTube show that an end user needs…
![](../../users/profiles/141318.webp)
timorzainf
- 101
- 1
- 1
- 3
9
votes
1 answer
Documented Best Practices for Reverse Proxy Implementation
I'm looking for some best practices documentation for implementation of a reverse proxy.
We need to allow an internal database / web server incoming access to the outside world and are trying to determine the most efficient and secure method to…
![](../../users/profiles/36901.webp)
Irongrave
- 191
- 1
- 1
- 2
9
votes
3 answers
Are future TLS versions going to prevent traffic inspection?
Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that receives the HTTPS connections and forge a on-the-fly…
![](../../users/profiles/91253.webp)
Eloy Roldán Paredes
- 1,507
- 12
- 25
8
votes
1 answer
What Steps Does An Anonymous Artist Need To Take to Retain Anonymity?
I read these questions which had great information: How can I keep my identity anonymous as a website owner/administrator? and How much can I trust Tor?, however I wonder if this is too extreme for my situation.
What I mean by this is I am not in…
![](../../users/profiles/50178.webp)
user50178
- 95
- 1
- 5
7
votes
1 answer
Restricting access to "hacking" sites and tools
I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy.
What are the potential benefits and risks of allowing access to such sites to developers and architects and how might we mitigate…
![](../../users/profiles/88460.webp)
JimmyJames
- 2,956
- 2
- 16
- 25
6
votes
4 answers
Burpsuite: just passthrough firefox detect portal
When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image:
How I can configure it to somehow just pass though theese requests silently and just load the target url?
I tried theese…
![](../../users/profiles/168285.webp)
Dimitrios Desyllas
- 381
- 1
- 2
- 13
6
votes
1 answer
How SSL/TLS handshake happens when we use Cloudflare Service?
I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare.
Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address of Cloudflare Data Center which communicates with…
![](../../users/profiles/159736.webp)
Shiv Sahni
- 921
- 8
- 16