Ask MetaFilter questions tagged with http

Are login boxes on http:// pages secure?

mono blanco — Tue, 01 Dec 2009 18:39:33 -0800

Some major websites--such as Facebook, Vox and others (but not Metafilter!)--have users enter username & password on an http page rather than an https page. Is this as secure as logging in via https:// and if so, why?

All HTTP requests time out, unless connected remotely via VPN.

tdischino — Tue, 17 Nov 2009 19:58:50 -0800

All HTTP requests time out, unless connected remotely via VPN. HTTPS (in my trusted sites) and FTP work fine. Somehow OpenDNS factors into this. I've seen this, but it's not exactly what is happening to me as far as I can tell. I consider myself a power user and somewhat technical, but realistically I know just enough computer-y stuff to make myself dangerous to myself, so take the rest with that in mind.

Within the network (when I am actually at work connected via ethernet or wireless), I get the same results. IS guys are slow to respond assuming I have some malware (although i've run malwarebytes about 5 times with consistent results - no infections). I consider myself a smart user , so I am not convinced this is foul play by some dumb virus and I don't visit nefarious sites (on the work lappy that is). I can only get HTTP to not timeout if I am connected remotely with the VPN (Cisco 5.0.01.0600, but this also happened under 4.8) running.

There are many things that i've tried or that were tweaked that I feel I need to include in this that I am afraid I might provide a lot of unimportant information. Please bear with.

Background: So, this is my work lappy (Dell Latitude D610) running WinXP fully patched. A week ago, I upgraded the Cisco VPN client from 4.8 to 5.0. The same day, I was given an AT & T GT Ultra 3G card. Every time I plugged the card in (having tried several drivers), Windows would BSOD. I decided to give up trying to get the card to work after several days. I uninstalled the drivers. I started experiencing this issue where HTTP requests would time out, somewhere between the first install of the card drivers, and giving up on the card. This included intranet and internet sites. My home page is an HTTPS site, so I didn't notice it immediately as it connects just fine, and a lot of my work sites are HTTPS (Not too mention, I've had a lot of remote connectivity over the past week or so, so it wasnt consistently occurring). Also, I started getting certificate errors when my Outlook (2007) would try to connect to the exchange server over a remote vpn connection (from home only). When I would look at the certificate, it referenced opendns.com. I use openDNS at home and have configured their name servers into my router.

So I did a system restore to a point before the card was installed. Well, since the VPN client was installed the same day as the card, I had to reinstall it as well. No Luck with HTTP unless I was over VPN. So I started searching the OpenDNS KB since the outlook exchange certificate errors were consistently occurring over the VPN connection, and found this. So I added my work domains to the exceptions, and everything was hunky dory again (until I got into work today and could not access much of anything). IS guy tried reinstalling XP SP3 today, didn't help. I tried uninstalling and reinstalling the VPN client today, didn't help.

Got home tonight, tried to connect to HTTP sites, no luck. Fired up the VPN, and here I am.

So, to recap, everything seems to work fine with VPN connection from home, behind OpenDNS. HTTP does not work if VPN is not running, or if I am within the physical network. If any of this makes sense, what piece(s) represent the wrench in the gears?

ping equivalent for web servers that reports http latency?

zippy — Sun, 03 May 2009 21:57:16 -0800

The equivalent of ping for http connections? I want to the equivalent of ping for webservers. I want to type in a simple command that generates 1 or more 1-line reports on the transaction: no. of bytes, response code, and round-trip latency.

For example, I would like to ask the tool to 'ping' my server once a minute for five minutes:

webping http://www.example.com/foo -i 60 -c 5

and see something like

1200 bytes (200) from www.example.com: seq=1 time = 240ms
1200 bytes (200) from www.example.com: seq=2 time = 240ms
1200 bytes (200) from www.example.com: seq=3 time = 240ms
1200 bytes (200) from www.example.com: seq=4 time = 240ms
300 bytes (404) from www.example.com: seq=5 time = 1500ms

Is there such a thing for linux/os-x? If not, is there a way to get what I want out of wget (shell / python munging of wget's STDOUT perfectly acceptable).

How does AJAX work with non-fixed-length HTTP responses?

xbonesgt — Thu, 23 Apr 2009 08:47:37 -0800

AskMe Programming Squad: Need some help with AJAX and a slightly unusual method of communicating with a remote server. I've been told to investigate the replacing of our product's current Java-based client with a Web-based one. Most of it is pretty straightforward, but I need some help to determine whether our existing client's method of communication with the backend can be replicated with AJAX.

The existing client communicates with the backend via HTTP, using two different threads:

Client thread #1 opens up a socket and sends out a series of POST requests which tell the backend what to do. Each request gets replied to with a standard HTTP 200 (or 403 or whatever) response.

Client thread #2, upon program startup, opens up another socket and sends a single GET request. As events occur on the backend, chunks of data get sent to the client as part of the response to this request. The client doesn't wait for this data in the form of a completed HTTP response, but basically does a select() on the socket and waits until it receives anything.

Thread #1 is easy to implement on the client-side using AJAX. I've done that a few times before. My question is, is it possible to do the same thing for thread #2? I've only used AJAX to fetch HTML documents or DOM elements or whatever from a remote server; this sort of open-ended stuff would be new to me. Changing the communication scheme isn't possible for a couple of reasons; I need to work with what I have.

thanks in advance for any help!

uploading/downloading huge files

Zed_Lopez — Tue, 26 Aug 2008 08:10:28 -0800

How to code a Perl web app to upload/download HUGE files? A straight HTTP upload/download for my app is untenable because I'm dealing with files of hundreds of megs each. I'd like to see a solution that would offer progress bars, and (more importantly) the ability to restart incomplete uploads or downloads.

The existing app is Apache 1.3/mod_perl/perl 5.8. Uploads require a login; downloads don't, but are limited inasmuch as they're keyed by UUIDs that are only considered valid in a short time-window. (I don't want the downloaders to see the real filename or location, but I suppose could make a link named for the UUID that gets deleted after its valid lifetime if I pursue an FTPish solution.)

I'm open to ditching doing the uploading and downloading in the browser if need be and requiring users to install client software to upload/download, but the download solution would need to be simple, easy, and available for all of Windows, Mac, and Linux. The upload solution would need to be simple and available for Windows.

But ideally, something AJAXy on the client-side and Perl (or plays-well-with-Perl) on the server-side can save the day and allow me to stick with the browser. I haven't done anything like this before. Anyone have any suggestions?

(3d-party hosting isn't an option.)

Why would email and MSN Messenger work, but web browsing not?

lukeo05 — Wed, 16 Jul 2008 13:24:04 -0800

Why would email and MSN Messenger work, but web browsing not? I got a phone call from a disgruntled mother, wondering why her colleagues home computer will access her email (via Outlook) and be able to use MSN Messenger, but cannot connect to the internet to browse. I'm sure if I sat down at the computer I would figure it out with trial and error, but that's not possible, so I am trying to think of a load of different suggestions of what to try to fix this issue...

Apache2, mod_php, suexec security confusion.

odinsdream — Tue, 10 Jun 2008 06:58:46 -0800

Apache2 security theory; mod_php versus CGI php and the use of suExec: What is the non-theoretical problem with running Apache2 with mod_php and thus without using suexec on a dedicated system? I'm setting up a typical LAMP environment. I've used phpsecinfo to evaluate my current environment and implemented all of the recommended changes except for two, Group ID and User ID.

The distribution is the most recent Ubuntu Server with the mostly-default Apache2 configuration, and the mostly-default PHP installation, with the exception of the changes recommended by phpsecinfo.

These warnings indicate that my group and user ID numbers are below 100 (33 to be specific), and therefore may be a problem. I am not sure how to interpret this.

I followed the documentation links and was about to implement SuExec when I realized that this meant doing a lot of other reconfiguration, like not using mod_php, and that meant changing a lot of other things, etc.

This is not a shared system. It will only be used to host one company's applications through several virtual hosts. The applications will be PHP-based, and most frequently will use the Symfony framework. Apache currently runs as www-data, whose shell is /bin/false. SSH access to the system is by public-key authentication only and is further restricted at the daemon level to only specific real users.

What do I need to do to run this securely? Resources, guides and real-world examples would be greatly appreciated.

Why can't I open webpages?

k8t — Mon, 09 Jun 2008 09:49:00 -0800

ADSL working but HTTP not working. I just got an ADSL connection (in Armenia, provider is Beeline, only documentation is here and is in Armenian. 256k though. Woo!)

I can use all sorts of applications pretty well (iTunes downloading podcasts, Flickr uploader, Outlook for mail, gChat, etc.), but I can't do anything HTTP. I open Firefox and can sometimes get a mobile page to load and I can search Google or Yahoo and see the results, but I can't open "normal" webpages at all. I tried IE and Opera but the same problem occurs.

I tried getting into the configuration page for the DSL modem, but doesn't look like it'll work well.

Also, suggesting updating firmware for DSL modem or something isn't possible. I am on really bad dialup otherwise.

Why would this be? (And yes, I've called tech support. They are less than impressive. They only introduced this service this month and aren't exactly supporting it.)

I am running Vista. I have tried to turn off all firewall-related stuff that I can possibly think of.

Any other ideas?

What lies between my browser and the internet?

miniape — Wed, 02 Apr 2008 22:11:24 -0800

I have an idea for a simple piece of software. It would involve intercepting browser requests, checking the requested url (probably not ip address, so before that conversion takes place) testing the url and redirecting if it passes the test. The test will itself make a network connection. Probably a pretty simple problem, but my background is in web development, and I'm foggy about 'OS' stuff, if that's even what it's called.

How are some ways I can go about this? I'd ideally like to write the program in Java or Python, but I'm not really looking for code specific information. I'm looking for google terms, useful libraries, descriptions of what happens step by step between the time I press enter on the keyboard and the time the request leaves the computer, generally strategies.

I'm guessing it might be hard because this is what a lot of spyware does, but I would be happy even if installation required some configuration.

Want the 411 on 301!

tcv — Tue, 04 Dec 2007 17:27:40 -0800

I recently purchased an SSL certificate for my website and have configured an application to operate over SSL. It's working well. One thing remains: I want to make sure that if someone tries to access the application over HTTP, the browser page is redirected to the SSL (HTTPS) version. I am fairly certain the pages the application creates are PHP, but I am unsure. (They're not static, I don't think. They're all dynamically created through mySQL.) The entry point for the application is a subdirectory off the domain /kb/. I'll add more answers if you folks need it. :-)

Hitting a URL from the command line

Null Pointer and the Exceptions — Wed, 11 Jul 2007 09:13:07 -0800

Alternatives to lynx, wget and get from the unix command line? I have a scheduled job that needs to hit a localhost URL once a day. Our servers don't have lynx or wget or get installed. Are there any alternatives? I've tried using telnet and Expect, and it works but when run through our scheduling app (Tivoli Workload Scheduler) I get a message "No environment-specified terminal type." even when I specify the terminal type. So I was wondering if there are other techniques I could try.

Why aren't my php files caching locally?

twine42 — Wed, 04 Jul 2007 06:22:45 -0800

Why aren't my php files caching locally? I'm using:

$offset = 3600 * 24;	

header("Expires: " . gmdate("D, d M Y H:i:s", time() + $offset) . " GMT");

header('Cache-Control: max-age='.$offset.', must-revalidate');

header("Last-Modified: " . gmdate("D, d M Y H:i:s", $date_cache)." GMT");

None of my php files are being cached in the browser while the js and image files are all getting cached just fine.

I'm using a default install of WAMP5 to put PHP from Win2003.

Help me find a cool little unix http utility I can't remember!

floam — Sat, 23 Jun 2007 23:37:05 -0800

I saw a really cool unix utility the other day blogged about somewhere, that in addition to some little boring http-ey tasks I can't remember, it also served as a tiny little HTTP-server-in-a-pinch like so: ./magicutil file.tar and boom, http://localhost/file.tar is alive. What was it!? Note: please don't try to find something that can /probably/ do this or show me a cool python script that will - this did some other cool stuff too I can't remember!

How do I set up a file server on a PC

Popcorn — Thu, 03 May 2007 15:44:34 -0800

How do I set up a file server on a PC w/ dynamicIP and a client web GUI? I'd like like to set up a server on my PC with the following features and considerations in mind:

-Can be accessed by clients from a browser via http so I can use no-ip.com's redirect service since I have a dynamic IP. This service doesn't seem to work w/ FTP addresses.

-Has a nice GUI that allows for clients to full download directories in the hierarchy. Something similiar to net2ftp.com's interface would be nice.

-Allows for different users and groups w/ different privileges

I currently have bulletproof FTP server running, and since I already have it configured w/ all the accounts I tried to set this up as per above in the following manner: Run Mbedthis AppWeb web server to run a local instance of net2ftp client which I downloaded from their site. This would then make a local connection to bulletproof and then I'd have all of the above. Turns out this is very difficult for me. I have about 4 credits introductory java experience and years of informal computer tinkering under my belt, but basically no programing/html skills.

So after hours of trying to get this to work, I've made a little progress but I'm stuck now. So I'm either looking for a single program that can do all this out of the box or some instructions on how make the no-ip>appweb>local net2ftp>bulletproof thing work.

Thanks!

How can I get a list of all files in a directory on a webserver?

newatom — Fri, 20 Apr 2007 08:09:28 -0800

I think the title explains it all: I'm looking to get a list of all files in a specific directory from a web server- www.site.com/docs/. The thing is, there's an index.htm file in that directory so if I browse to it, I just get the index file. Is there any way to find out the names of all files in that directory, scripting or otherwise? I don't have access to the system other than through the standard web interface(ie: no shell, etc.) Any ideas?

What data types should I use SSL to pass?

Ulleskelf — Wed, 11 Apr 2007 01:10:23 -0800

What's acceptable and best practice when it comes to passing data in on websites securely and non-securely? I've always presumed finanical information should be passed securely, whilst names and address were OK non-securely? Am I right? I run an health condition community where people have to enter their names, addresses, DOBs etc. One member asked to be removed as we weren't using SSL for their profile information. I'm (reasonably) happy that we aren't, but am I wrong? And are there any published guidelines?

Can I make AJAX work with HTTP authorization?

Godbert — Mon, 18 Dec 2006 18:33:43 -0800

Is it possible to make an AJAX request work with an HTTP authorization-protected server script? I have a personal CGI script which is protected with a "require user" directive in the .htaccess file. I'm trying to add a little bit of AJAX to it, but it's not working. A look at the logs indicates that the requests from the XMLHttpRequest object are failing with a 401 ("Not authorized") error and aren't submitting a username.

Google searching wasn't very helpful; there are lots of sites about "http authorization" that also include the term "AJAX" but only as part of an ad or navigation feature. Is it possible to make AJAX requests send along the same authorization information as the browser, and if so, how?

are http forms posted thru https secure?

Pasa la bola chetu — Fri, 13 Oct 2006 12:07:23 -0800

Can I deliver a form thru http, post it back to the server thru https and be secure? A friend says that if a form is delivered thru http and the form posts back to an https location it will be transmitted back unencrypted to the https port 443. For the form to post back encrypted, the original form must be delivered thru https.

Is this correct? Can you referr me to an authoritative doc that spells this out (rfc, w3c or browser developer doc)

(Tried using sniffers but on FF they showed unencrytped form info and on IE they showed encrypted.)

Where can I find global traffic stats broken down by protocol?

k7lim — Wed, 06 Sep 2006 10:32:04 -0800

I'd like a picture of just how much bandwidth the various TCP/UDP protocols (FTP, HTTP, NNTP, BitTorrent) take up along some large sample. Percent distributions would be fantastic. Anyone know where to get this data? My kung-fu helps me not.

Is DreamHost always this bad?

AmbroseChapel — Sun, 30 Jul 2006 14:52:14 -0800

Is DreamHost always this bad? Are they going to get better? I've been working with a client's site hosted with DreamHost. The number of outages, network problems and so on has been really quite unimpressive. I read their DreamHost Status page and shake my head. There's a new and quite serious problem every day.

This question addresses the same issue and someone in it says they suffered from DOS attacks. But that's not what's going on now. It's just one random thing after another. Plus, there are outages and failures to connect at my end (on "charm") that never get a mention.

I like DreamHost, their prices are good and their control panel and forums and so on make sense to me. Plus the fact that they're so big and popular means there's a decent community of users. I was considering hosting one of my own projects with them.

But seriously. The service just doesn't seem reliable. Are they going through a bad patch or is it all bad patch with them? Can I expect them to improve?

Looking for mp3 transcoding server

neustile — Thu, 27 Jul 2006 10:18:53 -0800

Looking for a MP3 transcoder/server. My dream piece of software runs as an apache module or standalone http server. Clients request a resource, like http://server/content/filename.mp3, over normal HTTP, but the transcoder intercepts that request and streams the mp3 file at a set normalized bitrate and quality, transcoding if necessary, and only transcoding/serving the requested content. The resultant stream has to be compatible with shoutcast-style mp3 stream players (iTunes, Winamp, QuickTime.) Does it exist? I know shoutcast has a transcoder, but it's geared towards playlists and not 'random access' http-type server applications. But I do want it to be like a radio, if someone hits stop in the middle of a file the server stops serving.

Browser download without a Content-Length header?

joegester — Thu, 20 Jul 2006 09:47:31 -0800

How do I get the browser to prompt a user to save a huge file when I don't know it's size in advance? I'm generating a large file on the fly and streaming it to the user's browser. When the download starts I want them to be prompted to save the file. Usually you can just set the Content-Length header to make this happen but because I'm building the file as it's transmitted, I don't know the length ahead of time.

When Content-Length isn't set, the behavior of both IE and Firefox is to download the entire file, then prompt the user to save it. This means that the browser sits there a long time spinning it's little spinner and probably making the user think nothing is happening.

Currently I'm setting Content-Type and Content-Disposition. If I do Content-Length="2147483647" (eg. 232, the save prompt comes up properly but says it expects 2GB of data and will take 100s of hours to complete.

I know I've seen Firefox send a file to the download manager without knowing it's size. How do you do it?

https from Google Talk client

friedrice — Fri, 17 Mar 2006 06:58:11 -0800

Is it possible to force gmail to open with https through the google talk client? When I click the inbox link in my google talk client or click on a new email that pops up, my gmail account opens in my browser through http. Is there something I can configure on my computer to force any http request to use https for specific domains?

What's the best http analytics tool?

bingo — Sat, 12 Nov 2005 09:25:59 -0800

Seeking recommendations for http analytics tools in the vein of HTTP Analyzer and Charles. Firefox compatibility and the ability to view the page and the data at the same time are big plusses.

How best to migrate from one domain to another?

AmbroseChapel — Fri, 11 Nov 2005 14:59:06 -0800

How best to migrate from one domain to another? Let's say I have a website at project.foo.com and I want to move it to its own "project.com". At some time in the future, project.foo.com will cease to operate.

How do I best migrate? And by best I mean "with the least, shortest disruption to visits from both search engines and human beings"

I can redirect by

changing the content to inform visitors of the new URL

using HTTP-EQUIV tags in pages

sending 301 HTTP headers from a script

using .htaccess files

changing the DNS entries

but which should I do, and when?

Let's say I absolutely don't want to lose a single hit from regular human browsing. I can imagine a very careful long-term transition like:

keeping the content, but adding a message to each page on the old domain: "project.foo.com/bar.htm will shortly move to project.com/bar.htm, please note"

moving the content and leaving only the message on each page: "project.foo.com/bar.htm has moved to project.com/bar.htm, please note"

after a certain period, removing all the pages, and redirecting any hit anywhere on project.foo.com to a "this whole domain has moved" page.

That seems like a good strategy for keeping my human hits, but it looks like a bad strategy for Google, etc.

So, say I just redirect the DNS? Or make every page issue a 301?

Presumably Google and other such agents (after a few hours downtime while the change propagates) will "see" the change, and redirect their links/update their database as required. But the humans might not have noticed. They ask for the content, they get the content. Why should they notice a new URL in the URL bar? So, they keep using their old bookmark and they haven't noticed the migration.

Should I attempt to to detect the fact that they came to project.com via a request to project.foo.com, and tell only those people that they should update their bookmarks?

Bonus question: am I over-thinking this?