Security – Blocking HTTP downloads but not HTTPS

httphttpsSecurity

Are there any security reasons why a network admin would block downloads over HTTP, but allow them over HTTPS?

Best Answer

If we talk about static file downloads without any authentication, the ability to ensure data integrity is one reason. However, encrypting the connection is just one tool for that as you could also use checksums to make sure that the data haven't been modified during the transmission.

However, blocking all HTTP downloads from anywhere will cause more problems than it would solve, as some content is only available on HTTP. From the opposite perspective, it's perfectly fine to provide downloads only via HTTPS for data integrity, and it additionally helps protecting the information on who downloaded what.

On the other hand, HTTP downloads have one advantage from the perspective of network administration: you can run virus (and other content) checks against the file in a firewall/UTM, before it even gets to the client computer. With HTTPS you would need to decrypt the TLS first; that would technically be a man-in-the-middle attack, while it has a legitimate purpose.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

NGINX – Proxy HTTPS Requests to an HTTP Backend

The type of proxy you are trying to set up is called a reverse proxy. A quick search for reverse proxy nginx got me this page:

http://intranation.com/entries/2008/09/using-nginx-reverse-proxy/

In addition to adding some useful features like an X-Forwarded-For header (which will give your app visibility into the actual source IP), it specifically does:

proxy_redirect off

Good luck! :)

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

NGINX – Proxy HTTPS Requests to an HTTP Backend

Related Topic