Geek Answers Handbook

Checksum in the header of an HTTP response - why not?

I would like to know some file checksum (e.g. SHA-256 hash or something else) when I start downloading the file from the HTTP server. It can be transmitted as one of the HTTP response headers.

Http etag looks like something similar, but it is only used to invalidate the browser cache, and as I noticed, each site calculates it in its own way, and it does not look like any hash that I know.

Some software download sites provide different file checksums as separate files for downloading (for example, the latest versions of Ubuntu 16.04 SHA1 hashes: http://releases.ubuntu.com/16.04/SHA1SUMS ). Wouldn’t it be easier to just include them in the header of the HTTP response and make the browser calculate it at the end of the download (and not force the user to do this manually).

I believe that the whole HTTP-based Internet works because we use the TCP protocol, which is reliable and ensures that the bytes received are exactly the same as the one sent by the server. But if TCP is so cool, why do we check file hashes manually (see Ubuntu example)? And a lot can go wrong during file loading (client / server disk corruption, server-side file modification, etc.). And if I'm right, everything can be fixed by simply passing the hash of the file at the start of the download ...

+8
source share
2 answers

Hashes on ubuntu.com and similar sites exist for two purposes:

  • check the integrity of the file (yes, presumably the browser can check it for you)
  • check the correctness of the file to avoid fraud (for example, an attacker can intercept your download request and serve as a malicious file for you. Although you can be reached by the https side of the browser, this is not true for data at rest, for example, an external USB drive, and you can check its correctness by comparing hashes)
0
source

Digest is a standard header used to transmit the checksum of the selected representation of the resource (i.e., the payload body).

Digest response example.

 >200 OK >... >Digest: sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE= > >{"hello": "world"}

Digest can be used both in the request and in the responses. It is recommended that you check the digest data before processing it.

You can find the linked page on the Mozilla website , which discusses in detail the content of the useful data in http.

I believe all HTTP-based internet is working because we use TCP

No, online integrity is provided by TLS. Non-TLS communications need not be trusted. See rfc8446

0
source

More articles:


All Articles