lesson 3

Question 1

Why is https important?

Answer 1

• Think that you are using a public wifi connection. Malicious cafe owners or malicious visitors can manipulate and see your http requests. With https you avoid these
• People can listen to the wifi reponses

Question 2

How to get a free certificate for the website?

Answer 2

• lets encrypt

Question 3

What is https?

Answer 3

• https = http + tls
• http = hypertext transfer protocol
• tls = transport layer security. TLS encrypts the communication so that it can only be read by the intended recipients.
• To ensure that you connect to the server that you intent to, TLS uses a chain of trust. The server identifies it self with a certificate that contains info about it and a fingerprint of its encryption key

Question 4

How is the TLS Handshake or process?

Answer 4

1) Server send the certificate with: public key, domain and its signature by certificate authority
2) The client checks if the domain is correct and if the signature is valid
3) The clients generates a random key for symmetrical encryption and encrypts it with the servers public key
4) The server can only communicate if it owns the random key.

Question 5

What page helps to see the behavior of chrome when problems in TLS?

Answer 5

https://badssl.com/

Question 6

What is mixed-content?

Answer 6

• It is when the server connection is https but not all its assets are.
• Assets like images, jquery, iframes, etc.

Question 7

How to test if the website has mixed-content?

Answer 7

• With a self signed certificate

Question 8

What is head of line blocking (HOL)?

Answer 8

• Is when other requests have to wait to start while one request finishes.
• This issue is revolved with http 2

Question 9

What is the problem with request headers?

Answer 9

• Request headers are not compressed and because of this they take a lot of memory.
• Compressing the headers helps so the requests are faster

Question 10

What are http2 improvements?

Answer 10

• human readability of request and response headers are gone and now they are compressed to maximize speed.
• No more head of line blocking. With multiplexing there just one connection with multiple streams. When one stream is blocked another one is put to work.
• http2 brings a big decrease in the time a requests takes.
• With http2 concatenate is not necessary. Most times it is a bad idea because it makes caching inefficient

Question 11

How to support http2 in your site?

Answer 11

• Enable http2 in your server

Question 12

Why is same origin policy important?

Answer 12

• If you were allow to make request to other origins then you could steal facebook messages