https

HTTPS connection with client certificate in an android app

by

There’s a simpler way to implement @jglouie ‘s solution. Basically, if you use a SSLContext and initialize it with null for the trust manager parameter, you should get a SSL context using the default trust manager. Note that this is not documented in the Android documentation, but the Java documentation for SSLContext.init says Either of … Read more

Replay attacks for HTTPS requests

by

HTTPS is not replayable, the first server response in the handshake sequence includes a server-chosen random number. What Fiddler does is act as a proxy, meaning it intercepts your browser’s requests, and then generates an identical request to the server, meaning it has access to the plaintext, which is what it will be replaying. Your … Read more

Is HTTPS the only defense against Session Hijacking in an open network?

by

Firesheep is nothing new. Session hijacking has been around for as long as web applications have been using Session IDs. Usually hackers just set their own cookie by typing this into the address bar: javascript:document.cookie=”SOME_COOKIE”. This tool is for script kiddies that fear 1 line of JavaScript. Cookies can be hijacked if you don’t use … Read more

HTTPS error “data length too long” in s3_pkt.c from Socket.io

by

I’m unsure weather it works. But here’s my idea/suggestion: Idea: I assume that you (possibly) tried to access a URL which is too long. This happens if data often is tansmitted via GET-Parameters. The official limit for a URL is below 512 Bytes. Details: The HTTP specification says that a protocol line may be at … Read more

Nginx Redirect HTTP to HTTPS and non-www to ww

by

The SSL redirect won’t work if your SSL certificate doesn’t support the non-www domain. The config is correct but can be reduced to just 1 redirect server Also don’t forget to reload Nginx sudo service nginx reload server { listen 80; listen 443 ssl; server_name example.com; # add ssl settings return 301 https://www.example.com$request_uri; }

Secure HTTP Post in Android

by

I’m not sure why you can’t handle HTTPS. I wrote a helper class for my own applications and I am able to GET/POST to HTTPS without a problem. I will post the code here and perhaps you can see if there are differences between my code and yours. import java.io.IOException; import java.io.InputStream; import java.io.UnsupportedEncodingException; import … Read more