HTTP Security Overview

HTTP Security

• HTTP is a protocol for transferring web pages
• HTTPS is a secure version of HTTP
• HTTPS uses SSL/TLS to encrypt data and authenticate the website
• HTTP uses port 80 and HTTPS uses port 443

HTTP Threat Model

• Eavesdropper: listens to conversations (confidentiality)
• Man-in-the-middle: modifies content (integrity)
• Impersonation: pretends to be a different website
• Bogus website: (authentication, confidentiality)

HTTPS: Securing HTTP

• HTTPS sits on top of the SSL/TLS secure channel
• HTTPS (using https://) versus HTTP (using http://) -Different TCP ports (TCP port 443 for HTTPS, TCP port 80 for HTTP)
• All HTTP bytes are encrypted and authenticated using HTTPS
• No change to HTTP itself, just the communication channel

Public Key Infrastructure

• Public key certificates bind identity (e.g., domain name example.com) with a public key.
• Digital signatures ensure integrity.
• Certificate authorities (e.g., GoDaddy) issue public key certificates and verify identities.
• Preconfigured certificates are in web browsers.

Enabling HTTPS for a Server

• Web Hosting Providers may offer HTTPS security.
• You can request and install an SSL/TLS certificate from a Certificate Authority.
• SSL/TLS certificates need periodic renewal.

HTTP vs. HTTPS

• HTTP sends data in plain text, allowing hackers to see login credentials and passwords
• HTTPS sends sensitive data encrypted, making it hard to read for a hacker
• Data sent with HTTPS looks different to the hacker (abErgdy#uwitWLqxytllqp), different from HTTP ([email protected])

Website Access Requested

• A browser requests access to a website.
• The browser sends a request to the Web Server.
• An SSL/TLS certificate is sent from the server.

Browser Validates SSL/TLS Certificate

• The browser checks if the certificate is valid, not expired, and matches the domain name.
• Checks if the certificate is issued by a trusted certificate authority.

Establishing a Secure Connection

• Browser generates a "pre-master secret," encrypts it with the server's public key.
• The server uses its private key to decrypt the pre-master secret.
• A session key is created from the pre-master secret (symmetric encryption)

Large-Scale Web Applications

• Web application architecture involves web browsers, web servers and storage system
• Web servers/application servers handle incoming requests.
• Storage systems (databases-e.g., MySQL, mongoDB) hold data and serve requests (i.e., SQL or NoSQL requests).

Scale-Up vs. Scale-Out

• Scale-up involves increasing the resources of a single server (increasing the capacity of a single server).
• Scale-out involves adding more servers to handle increasing load (increasing the number of servers to proportionally increase capacity).

Load Balancing

• Distribute HTTP requests across multiple front-end web servers using load balancers.
• Front-end machine accepts initial connections then redirects them to back-end machines (using algorithms)
• DNS (Domain Name System) load balancing - Handles distributing requests across geographically distributed systems.
• DNS servers dynamically rotate among these targets.
• Load-balancing switch (Layer 4-7 switch) directs incoming packets and connections to appropriate web servers.
• Stateless servers simplify load balancing.

Nginx (“Engine X”)

• Efficient web server handling thousands of HTTP connections.
• Load balancing - Forward requests to front-end servers.
• Fault tolerance - Handles failures of front-end servers.
• Handles simple requests (static files).

Scale-out Architecture (assumptions)

• Stateless servers: Different requests from the same user are handled by different servers.
• What about session state? Accessed on every request, require specialized handling. (e.g., memcache)
• WebSockets connect browsers and servers, making load balancing challenging.

Scale-out Storage

• Traditional web applications use relational databases.
• Single database instances don't scale well.
• Data sharding spreads data across multiple instances.
• Data replication creates backups and handles failures.
• Applications must partition data effectively.

Memcache

• Main-memory caching system.
• Caches results of recent database queries.
• Faster access compared to databases (500 microseconds vs tens of milliseconds).
• Widely used in applications like Facebook (over 200,000 memcache servers).

Cloud Computing

• Cloud computing dynamically allocates and provisions servers.
• The cloud provider manages infrastructure and capacity.
• Pay-as-you-go model (pay for resources used).
• Suitable for start-ups and scaling needs of organizations.
• Virtualization (key concept for accessing servers remotely).

Cloud Computing Pros/Cons

• Pros: Pay-per-use, flexible scaling, lower upfront costs, access to vast resources, many APIs (Application Programming Interfaces)
• Cons: Internet dependency, security considerations, vendor lock-in, lack of control

Higher Level Interfaces

• Managing virtual machines requires substantial skills.
• Higher-level interfaces like container systems (Docker/Kubernetes) shield developers from complexities of OS management.
• Manage storage using cloud databases (handling storage and data).
• Serverless architectures delegate server management to the cloud provider.

Cloud Database Storage

• Cloud-based database services rather than running instances.
• High availability, consistency and performance are essential features.
• Use queries to define schema, access required data.
• Pay for usage, based on data access.

Serverless Computing

• Cloud provider dynamically manages server allocation.
• Hidden server management and capacity planning from the developer.
• Developers focus on providing code - functions that run in response to events.

Serverless Architecture

• Code execution based events/URLs (like web servers - HTTP).
• Serverless-specific platforms (e.g., Amazon Lambda).
• Manage scaling and reliability through the platform.

Content Delivery Networks (CDN)

• Distribute web app assets efficiently across multiple servers.
• Fast asset delivery with closer servers to end-users.
• Reduces load on the main web servers.
• Works well with static content.

Cloud Computing & Web Apps

• Pay-as-you-go model supports scalability.
• Useful infrastructure services (auto-scaling, monitoring, fault handling).
• Cloud APIs offer analytical, machine learning and other tools.

Discussion (When to Build In-house Data Center Instead of Cloud)

• High consistent demand
• Strict security requirements
• Latency concerns /Performance
• Customization, specialized hardware needs
• Long-term growth and resources needs
• High data transfer costs / large data volumes
• Compliance needs and disaster recovery
• Financial viability and long-term commitment

This quiz covers the fundamentals of HTTP and HTTPS, including their differences, security protocols such as SSL/TLS, and the threat models associated with web communications. Test your knowledge on how these protocols protect data integrity and confidentiality against various security threats.