HTTP stuff

Question 1

HTTP Primer

Answer 1

• Hypertext transfer protocol: primary protocol for transmission of data over the internet
• Data is exchanged between clients and servers in the form of Hypertext documents.

Question 2

HTTP Headers

Answer 2

An HTTP header is a field of an HTTP request or response that passes additional context and metadata
about the request or response.

Question 3

HTTP Request Headers

Answer 3

A request header is an HTTP header that can be used in an HTTP request to provide information about the
request context, so that the server can tailor the response.

Question 4

HTTP Fetch Metadata Request Headers

Answer 4

*Fetch metadata request headers provide information about the context from which the request originated.
*This allows a server to make decisions about whether a request should be allowed based on where the request came from and how the resource will be used.

Question 5

HTTP Response Headers

Answer 5

A response header is an HTTP header used to give a more detailed context of the response.

Question 6

HTTP Security Headers

Answer 6

One of the easiest ways to secure a web application against common web security vulnerabilities is to
include HTTP security headers.

Question 7

Adding Default HTP Security Headers

Answer 7

• Can be done by using the Talisman package
• Talisman class includes almost all the important security headers by default

Question 8

Default HTTP Security headers

Answer 8

• Permissions-Policy: interest-cohort=()
• X-Frame-Options: SAMEORIGIN
• X-XSS-Protection: 1; mode=block
• X-Content-Type-Options: nosniff
• Content-Security-Policy: default-src ‘self’; object-src ‘none’
• Strict-Transport-Security: max-age=31556926; includeSubDomains
• Referrer-Policy: strict-origin-when-cross-origin

Question 9

TLS and it’s properties

Answer 9

Transport layer security, Any web application using HTTPS is therefore employing TLS encryption.

Properties:
Encryption - Hides data from third parties
Integrity - verifies data has not been forged or tampered with
Authentication - ensures that the parties exchanging information are who they claim to be

Question 10

How does TLS Work

Answer 10

1. (C-S) Client Hello
2. (S-C) Server Hello - including certificate
3. (S-C) Client certificate request
4. (C-S) Client Certificate
5. (C-S) Client sends key info
6. (C-S) Certificate verify
   7.(C-S) Finished messaged
   8.(S-C) Finished message

Question 11

Digital signatures