1

I'm trying to determine how much of a security risk I'm looking at when I have rubycas itself running over https, but my actual sites running under http. the reason I'm faced with this issue is that the sites are deployed on heroku, which means ssl is either really expensive or really a pain.

In addition to the login details, i also pass user rolls (authorization) to each site that is then stored in a session.

Any input is greatly appreciated.

Ryan
  • 668
  • 5
  • 12

1 Answers1

3

The problem with this approach is that neither the sessionid (url or cookie) nor the exchanged data is encrypted. Therefore the data can be read and manipulated both on the way from the server to the user and on the way from the user to the server.

Even a passive attacker that can just sniff the traffic without being able to manipulate it, can create damage: The attacker can just copy the sessionid into his or her own browser. Public wireless connections often use a transparent proxy, so both the attacker and the victim have the same public ip-address, which makes it difficult for the application to tell them apart.

There is a tool called Firesheep that makes this kind of attack extremely easy.

Hendrik Brummermann
  • 8,242
  • 3
  • 31
  • 55
  • if the cas server has ssl, the traffic to it would be secure, like entering credentials. An attacker would be able to control the session of the client, but not more. – oma May 22 '11 at 11:44
  • 1
    Controlling the session of the client is the worst case from the applications point of view and the second worst case from the users point of view. Don't take that lightly. – Hendrik Brummermann May 22 '11 at 13:57
  • I think that depends on that app. If you have a simple free app, as searching something and the need for a user is limited to saving searched or favouriting, a ssl certificate wouldn't be worth it. – oma May 22 '11 at 14:13
  • This is still data related to people, so it does deserve protection. If you are in a country with extremely weak consumer protection and privacy laws such as the USA, you may get away with it. I would not risk that in Germany. – Hendrik Brummermann May 22 '11 at 14:20