Ajax - HTTP site with JSONP API over HTTPS

Questions

Given all the coverage FireSheep has been getting, I have been trying to work out the best practices for balancing HTTP / HTTPS usage for some sites I manage (e.g. blogging sites, magazine sites with user contributed comments).

To me, its over kill to deliver all pages over HTTPS if the user is logged in. If a page is public (e.g. a blog) there is little point encrypting the public page. All I want to do is prevent session hijacking by sniffing cookies over HTTP channels.

So, one plan is:

• Login form is over HTTPS
• Issue two cookies: One cookie is public and identifies there user for read only aspects (e.g. welcome bob! ). The second cookie is private and HTTPS only . This is the cookie that is verified whenever the user makes a change (e.g. adds a comment, deletes a post).

This means that all changing requests must be issued over HTTPS.

We use a lot of AJAX. Indeed, many comment forms use AJAX to post the content.

Obviously, I cant use AJAX directly to post content to a HTTPS backend from a HTTP frontend.

My question is: Can I use script injection (I think this is commonly called JSONP ?) to access the API? So in this case there would be a HTTP public page that sends data to the private backend by injecting a script accessed via HTTPS (so that the private cookie is visible in the request).

Can you have HTTPS content inside a HTTP page? I know you get warnings the other way around, but I figure that HTTPS inside HTTP is not a security breach.

Would that work? It seems to work in chrome and FF, but its IE that would be the party pooper!

Answers

Another way is to have an iframe which points to a https page that can make all kinds (GET, POST, PUT etc) of Ajax calls to the server over https (same domain as iframe is on https too). Once the response is back inside the iframe, you can post a message back to the main window using HTML5 postMessage API.

Pseudo code:
    <iframe src="https://<hostname>/sslProxy">
    sslProxy:
        MakeAjaxyCall( GET ,  https://<hostname>/endpoint , function (response) {
            top.postMessage(response, domain);
        });

This works in all modern browsers except IE <= 7 for which you ll have to either resort to JSONP or cross domain communication using Flash.

Source

License : cc by-sa 3.0

http://stackoverflow.com/questions/4054525/http-site-with-jsonp-api-over-https

Related