HTTP vs HTTPS

HTTPS which stands for HyperText Transfer Protocol Secure, is the protocol with encryption that provides a safe transfer of data between systems.

The difference between HTTP and HTTPS is the safety provided by HTTPS. While HTTP lacks security, the data shared in the HTTP webpage is transferred as plain text which is readable by anyone who has relevant tools for that.

So, it leaves us to select HTTPS for websites that contain sharing of login information, personal information of individuals, payment-related information, and other pieces of information which needs very high privacy and security.

We can say, HTTPS is a secure version of HTTP(HyperText Transfer Protocol). Without HTTP, we cannot send or receive data between servers.

The website with HTTPS will have a lock icon near its domain URL.

Whereas, the website with HTTP will have a “Not secure” text instead of the lock icon near the URL.

How does HTTPS work?

HTTPS uses an encryption protocol named Transport Layer Security(TLS) which is still known by many as Secure Sockets Layer(SSL). TLS protocol secures the communication between two systems using asymmetric public-key encryption.

What is public-key encryption?

Public key encryption is the way of using two keys namely private key and public key to provide security for the data transferred. Data encrypted by the private key can only be decrypted by the public key.

The sender system sends the plain text which is encrypted by the private key.

The encrypted text then reaches the public key at the receiver side, and then the public key decrypts the encrypted text into plain text.

In this way, if any hackers try to intercept the message while flowing through the network, they will not see plain text, instead, they will see a mix of characters that will be harder to decrypt.

Here’s an example to show how encryption works:

Let’s say Bob sends a message “Hello” to Alice.

If Bob uses HTTP, that is, without any security in the protocol, then the message is sent as plain text.

This is very dangerous if we are sharing any data with high confidentiality such as our bank details, login details, payroll details of employees, and personal details of any individual or official details of an organization.

If Bob uses HTTPS, then his message will be encrypted and will be a mix of characters even if someone intercept and try to read it halfway in the network. It will be very difficult to decrypt the ciphered phrase without a public key.

This is very dangerous if we are sharing any data with high confidentiality such as our bank details, login details, payroll details of employees, and personal details of any individual or official details of an organization.

If Bob uses HTTPS, then his message will be encrypted and will be a mix of characters even if someone intercept and try to read it halfway in the network. It will be very difficult to decrypt the ciphered phrase without a public key.

So, from the above example, we can clearly say that without encryption, that is without HTTPS, it is very unsafe to communicate our details between the network.

Does HTTPS differ from HTTP?

HTTPS is not apart from HTTP and it is not a separate protocol from HTTP. It just used TLS/SSL encryption with HTTP. TLS/SSL certificate validates the websites whether they are the same ones as they have identified themselves.

After that they will create a user session, then the public key is shared with the other system to proceed with the sharing of data.

Then, TLS/SSL handshake happens, which is a series of back and forth communication to establish a secure connection.

TLS/SSL Handshake

TLS uses a client-server handshake which consists of exchanging keys between them to establish a secure connection. The whole process is breakdown into the following steps:

1. Both client and server exchanges encryption capabilities.

2. An authentication process happens by using the SSL/TLS certificate of the website to prove whether the other system is the same as the one which it claims it to be.

3. A session is exchanged between them.

TLS uses a public key exchange process to establish a secure connection between the connected devices.

Once the keys are exchanged and the session is created, then the safer transmission of data begins.

Best practices while implementing HTTPS

1. Get an SSL/TLS Certificate

• The SSL/TLS certificate is necessary to be obtained from a trusted Certificate Authority(CA) as a part of enabling the HTTPS website.
• While setting up the SSL/TLS certificate, it should be set up to a high level of security by choosing a 2048-bit key.
• If the website already has a certificate and if its security level is weaker, say it has a 1024-bit key, then it should be upgraded to a 2048-bit key to improve its security.

2. Check whether the HTTPS pages are indexed and crawled by Google

Since it is very necessary for our pages to be indexed and crawled by Google, we should make sure of the following things.

• noindex tags should not be included in the HTTPS pages.
• URL inspection tool can be used to check whether all the pages of the website can be accessed by Google bots.
• HTTPS pages should not be blocked by robots.txt files

3. Use HSTS

• HSTS, which stands for HTTP Strict Transport Security, is a mechanism through which a server indicates to the browser that it must use a secure connection while communicating with it.
• HSTS Policy is communicated to the browser by the server via an HTTP response header field named ”Strict Transport Security”.
• Doing so makes the insecure links into secure links in the web application.
• After this is done, if any user clicks or types an “HTTP” link, the user will be directed to the “HTTPS” link thus making the website secure.

4. Use permanent server-side redirects

• The users and the search engines should be redirected to the HTTPS page through a permanent server-side redirect.
• This is the best way to ensure that users and search engines are redirected to the correct page.
• The status codes 301 and 308 denote that a site has been permanently moved to a new location.

Common mistakes while implementing HTTPS

1. Using expired certificates will make websites vulnerable to hackers since they don't have upgraded security.

2. The web pages should not be blocked from crawling by using the robots.txt file.

3. Using old protocol versions is also very dangerous since they make the website vulnerable. So making sure, we are using the latest TLS protocol version is mandatory.

4. Taking care to embed only HTTPS contents on HTTPS pages is very necessary.

Using HTTPS is very important, especially in the modern era, where a website is more prone to attackers, we should make sure that SSL/TLS certificate is enabled in our website and all the above-mentioned points are taken care of so that when the user and the client communicates, it will be safe and secure.

---

Further Reading

1. What is Atatus APM and its Benefits?
2. What are the most common web application issues that you might face day-to-day in your application?
3. What is an API monitoring?