5

I am hosting a website on Amazon CloudFront and we've recently updated the distribution to require HTTPS between CloudFront and viewers. With the introduction of AWS Certificate Manager and the viability of SNI, this move is simple and cheap. The benefits of moving this to HTTPS are numerous.

I'm now wondering about the benefit of requiring HTTPS between CloudFront and my origin server (which is a custom origin). I know that would mean that CF would request all origin objects over HTTPS, but I'm struggling to find what benefit (security or otherwise) this provides. Is there a practical attack vector that could be exploited because requests to the origin are not made over HTTPS?

There is more administrative overhead to setting up and maintaining HTTPS on the origin server, so I want to know, do the benefits make that overhead worthwhile?

Ref: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/SecureConnections.html

  • 1
    HTTPS is always the way to go. Anything that is not using it is vulnerable to MITM attacks. Your current setup has a smaller attack surface than going http-only all the way, but still may be a good idea to put https between them. – cdvv7788 Feb 12 '16 at 20:13
  • Keep in mind that when you use a CDN as a proxy, their IP addresses will show up in DNS records, making it difficult to find the IP of the origin server. See Damon's (from CloudFlare) comment on the answer here: webmasters.stackexchange.com/questions/69044/… As a caveat however, you should make sure that all DNS records point to the CDN's IP addresses and that each record is being proxied, otherwise the IP address of the origin server will still be obtainable from a DNS lookup... – dan Feb 13 '16 at 1:19
  • That doesn't prevent hackers from scanning your server's network looking for IP's, but it does shield you somewhat from those specifically looking to do your particular site and visitors harm. For sensitive data (i.e., financial, private user information, etc...) it's recommended to maintain HTTPS on both ends. – dan Feb 13 '16 at 1:21
3

If an attacker is able to put themselves between your origin server and CloudFront edge location - it won't be so difficult for the attacker to capture your HTTP traffic and extract your information. Theoretically, it can be done on the side of your ISP. It is called as a "Man-in-the-middle" attack: https://en.wikipedia.org/wiki/Man-in-the-middle_attack

If you trust your ISP or hosting provider for 100%, you don't need HTTPS. Also, there is no need to encrypt public content. Anyway, the ultimate best practice is to use HTTPS always.

  • 1
    "If you trust your ISP or hosting provider for 100%" is a dangerous start. – Andrew Lott Feb 12 '16 at 17:56
  • If he is using cloudfront CDN to serve static content like images, css or js, then I don't think, it have any benefits regarding security. – Goyllo Feb 14 '16 at 8:01
0

It depends on your site.

If you run a special site involving high security and you want only select individuals located in several different countries with certain browsers to access your site and a login (or something unique to the user) is required to access the majority of the content on the site, then I'd say go for HTTPS.

If you have a generic site that presents information that you don't mind the whole world seeing, then HTTP for the html pages should be OK. Even though a hacker can download content via HTTP easier than with HTTPS, I still go with HTTP because it is a faster protocol and in order for pages to be indexed (especially by google), your site needs to run fast.

As for the man-in-the-middle attack that someone stated in their answer, It wouldn't matter much for a website that is meant for worldwide audience. I'd stick with HTTP and let the CDN download the site. There may be delays here and there while the hackers do their random seconds of glory. By that, I mean where they take a split second and suck up over 10 MB bandwidth in the split second. I know this from checking my server bandwidth graphs.

Now if you're doing a high-security site, HTTPS may help, but more importantly, you must make sure the scripts that process the site are 100% secure and bug-free.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.