https requests need to be encrypted

The HTTPS protocol request is composed of the KEY private key and the public certificate, which we know in our daily access, and it is the trust in the process of encrypted transmission of HTTPS data to ensure that the data is not hijacked.

HTTPS requests are encrypted. When the HTTPS protocol communicates, it will first use public key encryption to encrypt the key and then transmit it to the server, and after the server uses the private key to decrypt the key, the client and the server can establish a secure access channel. The next communication is carried out using the faster shared-key encryption for data transmission.

In this way, the HTTPS protocol has the security of public key encryption and the high speed of universal encryption.

Symmetric encryption: The same key is used for encryption and decryption, the client encrypts the data, and the server decrypts the data.

Asymmetric encryption: using a public key and a private key, the content encrypted by the public key can only be unlocked by the private key, and the content encrypted by the private key can be unlocked by all public keys. The private key is only stored on the server side, and the public key can be sent to all clients, which can ensure that the client cannot crack the content encrypted by the public key.

Generally, it is not required, and only in cases where the security requirements are extremely high, such as in the financial category, a second encryption is required.

CA is attacked, HTTPS security fails, and secondary encryption can prevent subsequent man-in-the-middle gank

2.In order not to appear plaintext in the whole process, the front-end performs secondary encryption:

For example, the login password is covered by * when entered;

It will not be clearly displayed in the request when it is sent (otherwise F12 will be able to see it);

To improve security to a certain extent, you may not be using your own computer.

Exceptions: Your keyboard, fingers are being monitored, or there is a virus on your computer, etc.) 3.The client rewrites the authentication interface (assuming it is a bug) so that the request is sent regardless of whether the verification is valid or not, then a second encryption is necessary.

It's a bit of a contradiction, maybe this is a malicious rewrite of the interface, of course, the developer will not encrypt it twice).

In summary: secondary encryption is useful, and it is safer to add than not to add, depending on the security standard.

HTTPS encrypts all communication between the client and the forward splitting server, including the following information:

1.Username and password: When a user enters a username and password on the login page, this information can be encrypted over HTTPS to prevent hackers from intercepting and stealing this sensitive information.

2.Credit card information: HTTPS protects the user's financial security by encrypting the credit card information when the user submits it.

HTTPS encrypts this cookie information to prevent hackers from stealing cookies and obtaining the user's login credentials.

In summary, HTTPS can encrypt any sensitive information transmitted between the client and the server to improve the security of user data and protect user privacy.

HTTPS (Hypertext Transfer Secure Protocol) is a secure version of HTTP, which adds an SSL TLS layer to the HTTP protocol, providing confidentiality and integrity for network communication. Specifically, HTTPS can encrypt the following information:

URL and HTTP header: HTTPS encrypts the key content of the entire HTTP request and response, including the URL, HTTP header, and HTTP request method (such as GET and POST).

GET POST request content: HTTPS ensures that the content of GET and POST requests is encrypted during transmission to prevent eavesdropping and tampering.

Cookies: Cookies transmitted over HTTPS are also encrypted, reducing the risk of cookies being stolen and tampered with. Li Feng.

Other content: HTTPS can also encrypt other types of data, such as AJAX requests, websocket communication, etc.

In short, HTTPS can encrypt all information transmitted through the HTTP protocol, protecting the security and integrity of data during transmission.

It can be understood this way. HTTPS is equivalent to adding Zen to the SSL layer under HTTP, and the full foundation of HTTPS is SSL, which requires SSL to return the details of this encryption.

It can be understood in this way that a digital certificate is added to this basis.

The main differences between HTTP and HTTPS are as follows:

1. The HTTPS protocol needs to apply for a certificate at CA, and there are generally fewer free certificates, so it requires a certain fee.

2. HTTP is a hypertext transmission protocol, information is transmitted in plaintext, and HTTPS is an SSL encrypted transmission protocol with security.

3. HTTP and HTTPS use completely different connection methods, and the ports used are also different, the former is 80, and the latter is 443.

4. The HTTP connection is simple and stateless; The HTTPS protocol is a network protocol built by the SSL+HTTP protocol that can carry out encrypted transmission and identity authentication, which is more secure than the HTTP protocol.

SSL Encryption Certificate Introduction:

SSL encryption certificate is a digital certificate, which mainly gives the HTTPS security protocol encryption transmission and trust function. Just like an ID card, you can prove your identity on the Internet. Before the encrypted transmission of data begins, the server tells the user that it is a trustworthy server through a "valid" SSL certificate, and establishes a two-way encrypted data transmission channel to ensure the security of data transmission.

The differences between https and http are as follows:1. The URL of HTTP starts with http:, while the URL of https starts with https:.

2. HTTP is insecure, while HTTPS is secure.

3. The standard port of HTTP is 80, while the standard port of HTTPS is 4434, in the OSI network model, HTTP works at the application layer, while HTTPS works at the transport layer.

5. HTTP cannot be encrypted, while HTTPS encrypts the transmitted data.

6. HTTP does not require a certificate, while HTTPS requires an SSL certificate issued by a CA.

The SSL certificate is installed on the first to upgrade the HTTP to the HTTPS encryption protocol to protect the data from being stolen, maintain the integrity of the data, and ensure that the data is not changed during transmission.

HTTP encrypted interface, the decryption process is in the program, and the security level is not high.

https will use the certificate, and the certificate is placed locally on the server, which will be more secure.

You can apply directly at: gworg.

How to apply: Send the required domain name or IP address to customer service and select the corresponding SSL certificate type.

According to the book and according to the certification requirements, the DNS resolution certification is completed.

Configure the SSL certificate to the server, and the installation method can be operated according to the GWORG technical documentation.

Implement https encryption, done.

Obtain an SSL certificate: After applying according to the above methods, log in to your email address to obtain the SSL certificate state search certificate.

Step 1: Submit the CSR to the ** vendor

The CSR (Certificate Signing Request) file must be generated by the user himself, or you can use the CSR generation tool. Select the product you want to apply, submit a new order, and submit the prepared CSR file.

Step 2 Submit the information to CA

After receiving your order and CSR, if it is a domain name verification certificate (DV SSL certificate), the certificate can be issued in about 10 minutes after the domain name verification, and if it is a certificate of other types, it needs to be verified by a CA before it can be issued.

Step 3 Send a verification email to the administrator's mailbox

Once the CA receives the information, it will send a confirmation letter to the administrator's email address with a corresponding link to the past. Each order has a unique PIN for verification purposes.

Step 4: Email verification

Click on the link in the confirmation letter, you can access the CA agency verification**, in the verification**, you can see the application materials of the order, and then click "I Approve" to complete the email verification.

Step 5 Issuance of certificates

After the user completes the email verification, the CA will send the certificate to the applicant's own email address by email, and the user can install it directly after receiving the certificate. If there is a problem with the installation of the Divination Ruler, we provide a free certificate installation service.

Fengxian is adapted from the original chapter of the same name.

Some digital certificates abroad are free, but everyone should understand the truth that they are cheap and not good. That kind of encryption strength is not much different from not doing it.

You need to apply for and purchase an SSL certificate.