Encrypting data over http without SSL

encryptionhttpsssh-tunnel

There is a web service that I am accessing, unfortunately, I can't paste the uri here because it is inside of an internal network and wouldn't do us any good here. The web service works great but the problem is the maintainers of it only support http and have no intentions of implementing https.

So, my question is… is there any way to force encryption without being able to use https? I imagine an SSH tunnel would be quite effective but I'm not sure how to implement it in this situation.

Any ideas?

Best Answer

SSH tunnels are quite simple. Just make sure the firewall doesn't allow HTTP out (it would render the tunnel pointless) and does allow SSH out.

Then it's just a matter of tunneling localhost:80 (or whatever the port is) to a local port for you.

Here's an example if your computer runs *nix:
ssh webserver.example.com -L 8080:localhost:80 -fN

This will work assuming the ssh server is the same as the web server, if it is not, use the web server's ip instead of localhost. The -fN puts the tunnel in the background, freeing up the terminal again.

Once the tunnel is up, you can browse the server on localhost:8080 on your computer.

If you are on a Windows machine, use something like PuTTY. Here is a good how-to with screenshots.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Best Answer

Related Solutions

nginx HTTPS – How to Serve HTTPS with Same Config as HTTP

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Related Topic