The difference between http and https

Question

What is the difference between HTTP header and HTTPS?

• What are the benefits of using HTTPS over HTTP?
• What settings need to be done to create an HTTPS website?
• Can we use HTTPS just for login and then onwords on HTTP?
• Is there any threat in HTTPS?
• Does the processing time for HTTPS take longer than HTTP?
• How does HTTPS cost more than HTTP?

Answer 1

• What are the benefits of using HTTPS over HTTP?

HTTPS means you are tunneling the HTTP through TLS/SSL , which encrypts the HTTP payload. Thus, the advantage is that HTTP requests and responses are reliably transmitted over the wire, for example. Your ISP does not know what you are doing.

2. How to use HTTPS?

Enable it on the endpoint, in general, the web server in front of your application server. Most web servers (e.g. IIS, Apache) support this configuration. Depending on your privacy requirements, this may not be enough.

3. Can we use HTTPS just for login and then onwords on HTTP?

Technically, this is possible, but it introduces some security risks. Example. After logging in securely, you pass in session identifiers that identify the user. If you pass these session identifiers insecurely (without SSL), session hijacking becomes a risk (“person in the middle”)

4. What settings need to be done to create an HTTPS website?

See No. 2. In public Internet scenarios, you must request (buy) a certificate from a specific certification authority (CA) so that end-user clients can verify that they must trust your certificate.

5. Is there any threat in HTTPS?

In the protocol itself, there is a small risk of man-in-the-middle attacks. For example. a proxy server between the client and the server can claim to be the server itself (this requires a successful attack on the network infrastructure, for example, DNS). There are several other “more obscure" risks that are not relevant to the protocol itself, for example:

• Using outdated encryption key length (e.g. 256 bits)
• loss of secret keys or inappropriate key management procedures (for example, sending via unencrypted email).
• Certificate Authority malfunction (just see press releases in 2011)

6. Does the processing time for HTTPS take longer than HTTP?

Yes, key negotiation (acknowledgment) requires a large processor capacity.

Answer 2

• HTTPS stands for http secure and provides encryption.
• You typically delegate this task to your web server.
• Yes it is possible.
• It depends on your web server, you must at least provide a certificate, and if your site is publicly available, you must buy it.
• HTTPS does not eliminate all threats, but does not add any of its own.
• Yes, this requires a bit more resources.

Answer 3

invite to see
http://www.wisegeek.com/what-is-the-difference-between-http-and-https.htm