HTTPS, TLS & Web Security

Every byte of data transmitted between your users and your servers traverses the public internet — a network you don't control. Without Transport Layer Security (TLS), anyone on the path (ISPs, Wi-Fi routers, government agencies) can read, modify, or inject content into that traffic.

[!IMPORTANT] As of 2024, Google Chrome marks all HTTP sites as "Not Secure" and penalizes them in search rankings. All production systems must use HTTPS. Free TLS certificates are available via Let's Encrypt, making there is zero excuse for HTTP in 2024.

Symmetric vs Asymmetric Encryption

PYTHON PLAYGROUND

⏳ Loading editor…

TLS Handshake Step-by-Step

OWASP Top 10 Web Vulnerabilities

PYTHON PLAYGROUND

⏳ Loading editor…

Quiz

Question 1 of 2

During TLS handshake, why does the server encrypt bulk application data with symmetric AES rather than the asymmetric RSA key it shared during the handshake?

AES keys are more secure than RSA keys

Asymmetric encryption (RSA) is ~1000x slower than symmetric encryption (AES) — using RSA for bulk data would make HTTPS too slow

AES works over the internet while RSA doesn't

Key Takeaways

✅ TLS is mandatory — use Let's Encrypt for free certificates; HSTS to enforce HTTPS.
✅ TLS handshake: asymmetric crypto establishes shared session key → symmetric AES encrypts all data.
✅ SQL Injection: always use parameterized queries — never string interpolation with user input.
✅ XSS: always HTML-escape output; use Content Security Policy; store tokens in httpOnly cookies.
✅ Secrets (API keys, DB passwords) must be in Vault/Secrets Manager — never in source code or environment files checked into git.

TLS 1.2 vs TLS 1.3 Comparison

Feature	TLS 1.2	TLS 1.3
Handshake RTTs	2 RTT	1 RTT (0-RTT for resumption)
Cipher Suites	Many (some weak)	Only strong suites
Forward Secrecy	Optional	Mandatory
SHA-1 Support	Yes	Removed
Performance	Slower	~40% faster connection setup
Adoption	Legacy	90%+ of TLS traffic (2024)
Downgrade Attack	Possible	Prevented

Official Resources

📖 OWASP Top 10 — The definitive web security vulnerability list
📖 Let's Encrypt — Free TLS certificates
📖 HashiCorp Vault — Secrets management
📖 Mozilla TLS Configuration — Recommended TLS settings generator

What's Next?

TLS secures individual connections — but how do you design an entire system that trusts nothing by default?
Next: Zero Trust Architecture — Identity-based perimeter, microsegmentation, and SPIFFE/SPIRE.