HTTP

HTTP status codes

HTTP 302

Cookie

  • Attributes

    • HttpOnly

      A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it is sent only to the server.

    • Secure

      A cookie with the Secure attribute is sent to the server only with an encrypted request over the HTTPS protocol, never with unsecured HTTP (except on localhost).

    • SameSite

      • Strict

        A cookie can only be sent to the domain which it originated from.

      • Lax

        Cookies are allowed to be sent with top-level navigations and will be sent along with GET request initiated by third party website. This is the default value in modern browsers.

      • None

        Cookies will be sent in all contexts, i.e sending cross-origin is allowed. It requires the Secure attribute in latest browser versions.

    • Domain

      A cookie is associated with a domain. If this domain is the same as the domain of the page you are on, the cookie is called a first-party cookie. If the domain is different, it is a third-party cookie.

Caching

  • Workflow

    1. Client sends the initial request
    2. Server returns 200 with resource and ETag representing its version
    3. Client caches resource and ETag
    4. Based on Cache-Control strategy, determine whether to request a new version of the resource
    5. If expired, send a request to server with If-None-Match: <ETag>
    6. Server returns 304 with empty body or 200 with new version of the resource and the new ETag

    The client may then decide to cache the representation, along with its ETag. Later, if the client wants to retrieve the same URL resource again, it will first determine whether the locally cached version of the URL has expired (through the Cache-Control and the Expire headers). If the URL has not expired, it will retrieve the locally cached resource. If it is determined that the URL has expired (is stale), the client will send a request to the server that includes its previously saved copy of the ETag in the "If-None-Match" field.[3]

  • Headers

    • Cache-Control - Define your caching policies

      • Gist

        • Request and response header
        • Client (User-Agent) makes the decision

      • Strategies

        • No caching
          • no-store
          • A request is sent to the server and a full response is downloaded each and every time.
        • Cache but revalidate
          • no-cache
          • A cache will send the request to the origin server for validation before releasing a cached copy.
        • Expiration - Duration in which the cache is served without checking freshness
          • max-age=<seconds>
          • max-age takes precedence over Expires

    • ETag

      • Gist

        • Server makes the decision
        • Response header
        • Represent the version of the requested resource (if it has been modified)
        • Value generation
          • Use cryptographic hash function to hash resource content
          • A hash of the resource last modification timestamp
          • Revision number
        • Validation
          • Strong: byte-for-byte identical
          • Weak: semantically equivalent

    • If-None-Match

      • Gist

        • Request header

        • If-None-Match is primarily used in conditional GET requests to enable efficient updates of cached information with a minimum amount of transaction overhead. When a client desires to update one or more stored responses that have entity-tags, the client SHOULD generate an If-None-Match header field containing a list of those entity-tags when making a GET request; this allows recipient servers to send a 304 (Not Modified) response to indicate when one of those stored responses matches the selected representation.

        • When used in combination with If-Modified-Since, If-None-Match has precedence (if the server supports it).

      • Workflow

        1. Request without If-None-Match header
        2. 200 Response with Etag <ETag> and resource in body
        3. Request with If-None-Match: <ETag>
        4. 304 Response with empty body

  • Resources

Cross-origin resource sharing (CORS)

  • A web application executes a cross-origin HTTP request when it requests a resource that has a different origin (domain or protocol or port or any combination of them) from its own.

  • CORS requests

    • Simple requests (opens in a new tab) don't trigger a CORS preflight.

    • Preflighted requests (opens in a new tab) first send an HTTP request by the OPTIONS method to the resource on the other domain, to determine if the actual request is safe to send.

      • Preflight Request Headers

        • Access-Control-Request-Method

          Notifies the server as part of a preflight request that when the actual request is sent, it will be sent with the specified request method.

        • Access-Control-Request-Headers

          Notifies the server that when the actual request is sent, it will be sent with specified headers.

      • Preflight Response Headers

        • Access-Control-Allow-Origin: Allowed origin host

        • Access-Control-Allow-Methods: Allowed HTTP methods for CORS requests

        • Access-Control-Allow-Headers: Allowed HTTP headers for CORS requests

        • Access-Control-Max-Age: How long the response to the preflight request can be cached for without sending another preflight request, value in seconds

  • Resources

Tools

Client

httpie

  • httpie - Usage (opens in a new tab)

  • Default

    • Headers

      GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: HTTPie/<version>
Host: <taken-from-URL>

    • HTTP redirects are not followed and only the first response is shown.

    • Content type

      Content-Type: application/json
Accept: application/json, */*;q=0.5
httpie - Use a HTTP proxy server
export ALL_PROXY=http://$proxy_ip:$proxy_port
export HTTP_PROXY=http://$proxy_ip:$proxy_port
export HTTPS_PROXY=https://$proxy_ip:$proxy_port
export NO_PROXY=$hostname1,$hostname2...
httpie - Download a file and save it via redirected output
http $url > $file
httpie - Upload a file using redirected input
http $url < $file
httpie - Upload a file as a multipart/form-data
http -f POST $url "${file_param_name}@${file}"
httpie - Dry run sending a request
http --offline ...
httpie - Print the whole HTTP exchange
http -v ...
httpie -
httpie - Print the specified parts of the HTTP exchange
CharacterDescription
Hrequest headers
Brequest body
hresponse headers
bresponse body
mresponse meta
http -p=$parts ...
httpie - Showing redirections
http -F --all pie.dev/redirect/3
httpie - Skip server SSL certificate verification
http --verify=no ...
httpie - Use a specified CA bundle
http --verify=$ca_bundle ...
httpie - Use a client side certificate for the SSL communication
http --cert=$client_cert $url

IntelliJ IDEA HTTP Client

  • Notes

    • All public environments must be in http-client.env.json, and file name cannot be changed, but location can be changed.

    • All private environments must be in http-client.private.env.json, and file name cannot be changed, but location can be changed.

    • Define a local variable

      ### Get stub mapping by ID
@mappingId = 4694d48a-5bdc-476b-8d15-a48751c30d75
GET {{host}}:{{port}}/__admin/mappings/{{mappingId}}

  • Resources

Packet Analyzer

mitmproxy

  • GitHub - mitmproxy/mitmproxy (opens in a new tab)

  • Proxy Modes (opens in a new tab)

    • Recommended

      • Regular: The default mode. Configure your client(s) to use an HTTP(S) proxy.
      • Local Capture: Capture applications on the same device.
      • WireGuard: Capture external devices or individual Android apps.
      • Reverse: Put mitmproxy in front of a server.

    • Advanced Modes

      • Transparent: Capture traffic with custom network routes.
      • TUN Interface: Create a virtual network device to capture traffic.
      • Upstream: Chain two HTTP(S) proxies.
      • SOCKS: Run a SOCKS5 proxy server.
      • DNS: Run a scriptable DNS server.

mitmproxy CLI

Intercept everything on this machine
mitmproxy --mode local
Intercept cURL only
mitmproxy --mode local:curl
Intercept cURL and wget only
mitmproxy --mode local:curl,wget
Intercept the specified process only
mitmproxy --mode local:$PID
Intercept everything on this machine but cURL
mitmproxy --mode local:!curl

References

Web Application SecurityHousing