CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
A browser shows a warning: 'Mixed Content: The page at https://secure.example.com was loaded over HTTPS, but requested an insecure resource http://cdn.example.com/script.js'. Why is this a security problem?
- A.HTTPS pages load faster and HTTP resources slow them down
- B.HTTP CDN resources do not support modern compression algorithms
- C.Loading active content (scripts, iframes, forms) over HTTP on an HTTPS page undermines the entire page's security - an attacker who can MITM the HTTP request can inject malicious JavaScript that executes with full access to the HTTPS page's DOM, cookies, and credentials
- D.Mixed content only affects image and media resources, not scripts
Why C is correct
Mixed content breaks the security model of HTTPS. 'Active' mixed content (scripts, iframes, stylesheets, forms) is blocked by modern browsers because an attacker who can intercept the HTTP sub-resource can inject malicious code running in the context of the HTTPS page - defeating TLS protection. 'Passive' mixed content (images, video) is allowed with a warning since it cannot directly run code. The CSP 'upgrade-insecure-requests' directive automatically upgrades HTTP sub-resource requests to HTTPS.
Know someone studying for Web App Fundamentals? Send them this one.