Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

For the encryption and decryption to happen in a secure way we have to define what cipher suite we want to cover. The strength of the TLS is directly dependent on the cipher suite that we decide to use. The servers should be configured to disable all week ciphers. The  

While choosing a cipher for the encryption choose one that supports PFS, A cheat sheet for ciphers can be found in https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet. In the list, you can use any ciphers on the A+, A or B category.

Additional requirements

Having TLS enabled only on certain pages does not accomplish what was intended. For optimum results, these guidelines[1] should also be followed

DescriptionWebAppRest Client
All pages must be served over HTTPS. This includes CSS, scripts, images, AJAX requests, POST data and third party includes. Failure to do so creates a vector for man-in-the-middle attacksYesNA
Just protecting authenticated pages with HTTPS, is not enough. Once there is one request in HTTP, man-in-the-middle attacks are possible, with the attackers being able to prevent users from reaching the secured pagesYesNA
The HTTP Strict Transport Security Header must be used and pre-loaded into browsers. This will instruct compatible browsers to only use HTTPS, even if requested to use HTTPYesYes
Cookies must be marked as SecureYesNA




Reference

  1. https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet
  2. https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices
  3. https://www.owasp.org/index.php/TLS_Cipher_String_Cheat_Sheet

...