background preloader

The First Few Milliseconds of an HTTPS Connection

The First Few Milliseconds of an HTTPS Connection
Convinced from spending hours reading rave reviews, Bob eagerly clicked “Proceed to Checkout” for his gallon of Tuscan Whole Milk and… Whoa! What just happened? In the 220 milliseconds that flew by, a lot of interesting stuff happened to make Firefox change the address bar color and put a lock in the lower right corner. With the help of Wireshark, my favorite network tool, and a slightly modified debug build of Firefox, we can see exactly what’s going on. By agreement of RFC 2818, Firefox knew that “https” meant it should connect to port 443 at Amazon.com: Most people associate HTTPS with SSL (Secure Sockets Layer) which was created by Netscape in the mid 90’s. Client Hello TLS wraps all traffic in “records” of different types. The next two bytes are 0x0301 which indicate that this is a version 3.1 record which shows that TLS 1.0 is essentially SSL 3.1. The handshake record is broken out into several messages. Server Hello Checking out the Certificate Why should we trust this certificate?

The Rhetoric of the Hyperlink The hyperlink is the most elemental of the bundle of ideas that we call the Web. If the bit is the quark of information, the hyperlink is the hydrogen molecule. It shapes the microstructure of information today. Surprisingly though, it is nearly as mysterious now as it was back in July 1945, when Vannevar Bush first proposed the idea in his Atlantic Monthly article, As We May Think. Image from Wikipedia, free license Hyper-Grammar and Hyper-Style The hyperlink is not a glorified electronic citation-and-library-retrieval mechanism. This is the default mental model most people have of hyperlinks, a model borrowed from academic citation, and made more informal: Implicit inline: Nick Carr believes that Google is making us stupid.Explicit inline: Nick Carr believes that Google is making us stupid (see this article in the Atlantic). Both are simple ports of constructs like “Nick Carr believes [Carr, 2008] that Google is making us stupid.” Hyperlinking as Form-Content Mixing That’s not all.

ReverseHttp Http-https transitions and relative URLs When building a web site with HTTPS pages, one of the annoying tasks is to ensure that those pages make no references to HTTP resources. If they do, then Internet Explorer will pop up alarming messages about mixing secure and insecure content, and do you want to display the insecure content. This confuses users and generally discourages them from continuing to use your site. To fix the problem, all URLs on the page must use HTTPS. Relative URLs are the answer. Either of these images will display without warning on either HTTP or HTTPS pages. But what if you need to pull resources from another site? If this reference appears in an HTTPS page, the mixed content warning will appear. Here, we've left off the protocol scheme, but included a host name. You have to be careful to only use this syntax in pages destined for browsers. <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="//download.macromedia.com/pub/shockwave/cabs/flash/blah#blah" width="600" height="400"> ...

Implementing a simple HTTP/Web server in java for handling POST Note: An updated version of this post can be found in which will handle any kind of file uploads (text and binary files) of large size. In the last section on java, we have seen how to implement a simple/lightweight HTTP/Web Server to handle HTTP GET methods. In this section, we will see how to implement a simple HTTP/Web server in java to handle POST methods with an example of a file upload server using the POST method through a client form data. The benefit of implementing our own HTTP Server to handle GET/POST methods is that we can use them for some simple/lightweight applications which doesn't require an Apache Web server or a servlet container to be deployed to handle HTTP client requests, also these simple HTTP servers can be used as utility classes which can be integrated in a small scale applications. The below HTTP POST Server does the following functions. 1. 2. 3. So here's the code. Working:

libebb libebb is a lightweight HTTP server library for C. It lays the foundation for writing a web server by providing the socket juggling and request parsing. By implementing the HTTP/1.1 grammar provided in RFC2612, libebb understands most most valid HTTP/1.1 connections (persistent, pipelined, and chunked requests included) and rejects invalid or malicious requests. libebb supports SSL over HTTP. The library embraces a minimalistic single-threaded evented design. No control is removed from the user. For example, all allocations are done through callbacks so that the user might implement in optimal ways for their specific application. libebb depends on POSIX sockets, libev, and optionally GnuTLS. libebb is in the early stages of development and probably contains many bugs. libebb is released under the X11 license. Usage libebb is a simple API, mostly it is providing callbacks. callbacks to allocate and initialize data for libebb. ebb_server my_server->new_connection = my_new_connection_callback;

Data encoding in HTTP This is the final chapter in a series I have been running on my evolving understanding of 4+1 view architectural descriptions. This time around I am covering scenarios, and other things that might end up in an architectural description. We have already established the set of components in our architecture, and the functional interfaces to external systems. We have drawn links between components, but not really elaborated on where responsibilities lie between a given pairing of linked components. Scenarios The scenarios view seems to be the most flexible of the views, and seems to capture "other". Recording of sales is a fairly straightforward transfer of Sales Records from Web Browser to the Sales Manager Component. It is possible that we could talk more about the user interface than I have in this diagram. Another way to approach the Scenarios View would be to take things back up a notch. I haven't included all of the images this time around. The Rest Clearly 4+1 is not the whole story.

Describing HTTP requests I was having a chat on an internet forum. Basically, a person was wondering how HTTP connections work, also, how do they apply to HTTPs and proxy server requests. Here is my take, written in forum casual dialog. I think I understand what you are trying to do. But I don't understand why you need the proxy software. Your goal is to successfully log into a HTTPS site. I do this a lot with java. Part A:javax.net.ssl.SSLSocketFactory sf = (javax.net.ssl.SSLSocketFactory) javax.net.ssl.SSLSocketFactory.gtDefault();javax.net.ssl.SSLSocket sock = null;X509TrustManager tm = new MyX509TrustManager();HostnameVerifier hm = new MyHostnameVerifier(); ...And then I do this:Part B:URL url = getSSLURL(fullURL);conn = (HttpsURLConnection) url.openConnection();...My point, Part A is kind of complicated, that is required to initialize SSL for a HTTPS request. (Example 1, assuming no proxy)Assuming you don't have the proxy in between the client and the server. Stateless request from Client 1. The proxy. E.g.

Related: