security of http to https redirect

Question

I have a website that is 100% https and will only work as https. My site is an asp.net mvc application running on IIS 7.5.

It is on multiple servers with traffic distributed via a load balancer.

I am not in control of the hardware.

For http requests, I was hoping that it could be stopped at the load balancer and a redirect to https at this point.

However the hardware company wont do this for me, and instead I need to do the redirect from http to https within IIS on the server. Therefore unencrypted traffice can enter the inner network with redirect being at the server level. I would feel more comfortable with such a transfer happening at the load balancer.

Do I have valid concerns?

Answer 1

Threat model:

HTTP request:

           Attacker
              |         Security Boundary
              V         V
Client -- http request --> Load Balancer 
                               |
Client <-- redirect -----------+

Threats which occur from allowing HTTP redirects regardless of methodology:

• Spoofing: Client could connect to MITM spoofed HTTP server which does not pass through the redirect, but instead proxies connections to the actual HTTPS server
• Tampering: Client could receive redirect URL from MITM spoofed server which directs them to another action (E.g.: client receives redirect to https://yoursite.com/login.aspx?redirect=/deleteAllDocuments)
• Information Disclosure: Initial HTTP request is disclosed, any information in POST or GET is available unencrypted to eavesdroppers.

Arguments for performing redirect on server other than target server:

• Firewall can be limited to HTTPS data, limiting risk of unencrypted data due to misconfiguration
• Configuration and liability could become "Someone else's problem", from at least a political perspective
• Vulnerabilities in HTTP server would be isolated and could not be used to attack HTTPS server or underlying application

Arguments for performing redirect on something other than the load balancer:

• Load balancers are not servers
• Load balancers are not servers, and therefore might have lightly used code paths when used as servers, which could be more prone to undiscovered bugs or performance problems
• Configuration is not available to you, but you (or your company) is still probably liable for any misconfigurations which occur (from a legal perspective)

In light of the above analysis, for highest security with lowest risk:

• I would not put the redirect on the target server, nor the load balancer, but instead on a VM which only serves to redirect pages. A minimal Linux or windows box should be able to be tightly locked down to limit exposure.
• I would not allow redirects with a query-string or POST data (E.g.: show 404 for any non GET / HTTP/1.1 request)
• I would call the possibility of spoofing and tampering an acceptable risk, or show a page to the user explaining that the site must be accessed using HTTPS instead of using a redirect

But, if you can assume the following conditions are met, placing the HTTP server co-resident with the HTTPS server should not reduce security.

• Any bug in the HTTP server is present in the HTTPS server
• The HTTP server is correctly configured to disallow access to protected resources (set up as a separate site in IIS, for example. Secure site still has no HTTP binding)
• No other application is able to create a server on HTTP (netsh urlacl only has IIS, for example)
• Configuration is audited to ensure the above configurations are properly maintained (Periodic pen tests, manual configuration review, configuration change management, and an IDS or IPS system)

In some cases, the reduced complexity may even be easier to secure than a separate server. Additionally, if the administrator is unfamiliar with the load balancer's configuration, they may be more prone to make a critical error in configuration than if they were to make the same configuration in a product they know well.

Answer 2

Do I have valid concerns?

Do you have a valid concern about the initial connection being over HTTP? Sure. The initial request can be intercepted and the response spoofed in a MitM attack. The attacker can then either prevent the user from using HTTP (adding ssl/tls between the attacker and your server and relaying to the victim in the clear) or can create an imposter SSL session with the client that terminates at the attacker before being re-encrypted on it's way to you (using various spoofing techniques to make the attack less obvious to the casual user).

However, if such an attack were launched, I would be far more worried about the transit from the client to your load balancer, not between your load balancer and IIS. If you suspect that you have malicious systems behind your load balancer, you have an entirely different set of problems.

Answer 3

See my answer over on security.so for some relevant information regarding redirects from HTTP to HTTPS.