Handbooks / Web Security (OWASP) / Chapter 5

HTTPS and Secrets

7 pages · ~5 min✓ Reviewed

Builds on CSRF and CORS.

Web Security (OWASP)Page 1

TLS Mental Model and Handshake

1. Three Guarantees

Confidentiality: encryption
Integrity: tamper detection
Authentication: server proves identity via its certificate

2. Handshake and Keys

ClientHelloversions, ciphers, key share
ServerHello+ certificate + Finished
Client Finisheddata flows

TLS 1.3 costs 1 round trip
Key exchange is ephemeral ECDHE: forward secrecy
A stolen server key cannot decrypt past recorded sessions

	Job	Speed
Asymmetric	authenticate, agree on key	slow
Symmetric (`AES-GCM`, `ChaCha20`)	bulk data	fast

3. Interview Point

Walk through the handshake? Hello with key share, server hello + cert + Finished, client Finished.
Forward secrecy? Per-session keys, so a later key theft reveals no old traffic.
Why not encrypt all data with the public key? Too slow; it only authenticates and agrees on a key.
1.3 removes vs 1.2? RSA key exchange, weak ciphers, extra round trip.

Remember

Asymmetric crypto sets up the key; symmetric encrypts the data.

Web Security (OWASP)Page 2

Certificates and HSTS

1. Chain of Trust

Leafkey + SAN
Intermediatesigned by root
Trusted rootin OS store

X.509 binds a public key to a domain (SAN), signed by a CA
Client checks the chain, expiry and hostname match

bash

openssl s_client -connect example.com:443 -servername example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates

x509 reads stdin, so pipe s_client into it

output

notBefore=Jan  1 00:00:00 2026 GMT
notAfter=Apr  1 00:00:00 2026 GMT

2. HSTS

http

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Browser forces HTTPS and blocks click-through on cert errors
Active only after the first HTTPS visit, unless preloaded
First plain HTTP request can be intercepted: SSL stripping

3. Interview Point

How is a chain validated? Signatures leaf to intermediate to trusted root, plus expiry and hostname.
HSTS vs a 301? A 301 still starts on plain HTTP and can be stripped; HSTS skips HTTP and blocks bypass.
Preload risks? Hard to undo, and every subdomain must support HTTPS.

Web Security (OWASP)Page 3

Secure Headers

1. Response Headers

CSP limits script, style and frame sources
Main defence against XSS impact
nosniff stops MIME sniffing
Referrer-Policy limits URL leakage

http

Content-Security-Policy: default-src 'self'; script-src 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

baseline response headers

2. Framing and Cookies

Setting	Blocks
`frame-ancestors 'none'`	page being framed
`X-Frame-Options: DENY`	framing (older)
`Secure`	cookie over plain HTTP
`HttpOnly`	JS reading the cookie
`SameSite=Lax` or `Strict`	most CSRF

3. Check and Interview Point

bash

curl -I https://example.com

-I fetches response headers only

CSP and 'unsafe-inline'? CSP blocks injected scripts; inline allowance lets them run again
Cookie flags? Secure, HttpOnly, SameSite: stop sniffing, theft and CSRF
Check headers? curl -I, look for CSP and nosniff

Mistake

CSP with 'unsafe-inline' in script-src gives up the XSS defence.

Web Security (OWASP)Page 4

Secrets Management and Supply Chain Risks

1. Secrets

.env in .gitignore; scan with gitleaks or trufflehog
Secret in git history = compromised: rotate it
Deleting the commit is not enough

Load at runtime: Secrets Manager, Vault, cloud KMS, or injected env vars
Least privilege, rotation, short-lived credentials

2. Supply Chain Risks

Risk	Meaning
Known CVEs	Vulnerable dependency version
Typosquatting	Look-alike package name
Dependency confusion	Public package shadows an internal name
Install scripts	Malicious code runs on install

3. Defences

Commit lockfiles, pin versions
npm ci installs exactly the lockfile, fails on mismatch
Audit with npm audit or Dependabot
Generate an SBOM; verify provenance and signatures

bash

npm ci
npm audit

4. Interview Point

Key pushed to GitHub? Revoke and rotate it, then scan history
Dependency confusion? A public package shadows an internal name
Lockfile + npm ci in CI? Reproducible, pinned installs; no surprise versions

Web Security (OWASP)Page 5

OWASP Top 10 at a Glance

1. The 2025 List

ID	Risk	Fix
A01	Broken Access Control (incl. SSRF)	Server-side authz, deny by default
A02	Security Misconfiguration	No default credentials
A03	Software Supply Chain Failures	Patch libraries
A04	Cryptographic Failures	HTTPS, strong hashing
A05	Injection	Parameterized queries
A06	Insecure Design	Threat modelling
A07	Authentication Failures	MFA, rate limiting
A08	Software or Data Integrity Failures	Signed updates
A09	Logging and Alerting Failures	Log auth events, alert
A10	Mishandling of Exceptional Conditions	Fail closed

2. Key Fixes

IDOR: change /orders/7 to /orders/8, read another user's order
Hash passwords with bcrypt or argon2, never MD5 or SHA-1
Allowlist outbound URLs to block SSRF to the metadata endpoint

Never string-concatenate user input into SQL

python

cur.execute("SELECT * FROM users WHERE id = %s", (uid,))

Remember

Authorize on the server, on every request.

Web Security (OWASP)Page 6

Security Cheat Sheet

1. TLS and Checks

TLS 1.2 or 1.3 only
ECDHE for forward secrecy
Auto-renew certs (Let's Encrypt/ACME)
Send the full intermediate chain

bash

openssl s_client -connect host:443 -servername host
curl -I https://host
openssl s_client -connect host:443 -servername host </dev/null | openssl x509 -noout -dates

curl -I: look for HSTS and CSP

2. Header Baseline

Header	Job
`Strict-Transport-Security`	force HTTPS
`Content-Security-Policy`	limit sources
`frame-ancestors`	block framing
`X-Content-Type-Options: nosniff`	no MIME sniffing
`Referrer-Policy`	limit URL leakage

Cookies: Secure + HttpOnly + SameSite

3. Secrets and Supply Chain

No secrets in git
Rotate on leak
Least privilege
Lockfile + npm ci
Audit dependencies
Minimal base images

4. Common Mistakes

Expired certs
Mixed content
HSTS preload before all subdomains support HTTPS
Wildcard CORS with credentials
Verbose errors
Trusting client-side checks

Web Security (OWASP)Page 7

Check yourself

HSTS is set with max-age=31536000. A new user types http://shop.com. Is that first request protected?

No: the browser only learns HSTS from an HTTPS response.
The plain request can be stripped; the preload list closes that gap.

A key was pushed, then the commit was force-pushed away. Is it safe?

No: clones, forks and caches may still hold it.
Rotate the key first, then clean history.

Set-Cookie: sid=abc; Secure. Can an XSS script steal it?

Yes: without HttpOnly, JS reads it via document.cookie.
Add HttpOnly, and SameSite=Lax against CSRF.