HTTP is used for communications over the internet, so application developers, information providers, and users should be aware of the security limitations in HTTP/1.1. This discussion does not include definitive solutions to the problems mentioned here but it does make some suggestions for reducing security risks.
HTTP clients are often privy to large amount of personal information such as the user"s name, location, mail address, passwords, encryption keys, etc. So you should be very careful to prevent unintentional leakage of this information via the HTTP protocol to other sources.
All the confidential information should be stored at the server in encrypted form.
Revealing the specific software version of the server might allow the server machine to become more vulnerable to attacks against software that is known to contain security holes.
Proxies that serve as a portal through a network firewall should take special precautions regarding the transfer of header information that identifies the hosts behind the firewall.
The information sent in the "From" field might conflict with the user"s privacy interests or their site"s security policy, and hence, it should not be transmitted without the user being able to disable, enable, and modify the contents of the field.
Clients should not include a Referer header field in a (non-secure) HTTP request, if the referring page was transferred with a secure protocol.
使用HTTP协议的服务的作者不应该使用基于GET的表单来提交敏感数据，因为这将导致数据在Request-URI中进行编码。
该文档应限于HTTP请求所返回的文档，仅作为服务器管理员打算的文档。
例如，UNIX，Microsoft Windows和其他操作系统使用“..”作为路径组件，以指示目前级别高于当前级别。在这样一个系统上，HTTP服务器必须禁止Request-URI中的任何这样的结构，否则它将允许访问旨在通过HTTP服务器访问的资源。
Clients using HTTP rely heavily on the Domain Name Service, and are thus generally prone to security attacks based on the deliberate mis-association of IP addresses and DNS names. So clients need to be cautious in assuming the continuing validity of an IP number/DNS name association.
If HTTP clients cache the results of host name lookups in order to achieve a performance improvement, they must observe the TTL information reported by the DNS. If HTTP clients do not observe this rule, they could be spoofed when a previously-accessed server"s IP address changes.
如果单个服务器支持多个不相互信任的组织，那么它必须检查在所述组织控制下生成的响应中的位置和内容位置标题的值，以确保它们不会尝试使资源无效他们没有权威。
现有的HTTP客户端和用户代理通常会无限期地保留认证信息。HTTP / 1.1不提供一种服务器的方法来指示客户端丢弃这些缓存的凭据，这是一个很大的安全风险。
这个问题的部分内容有很多工作，因此建议在屏幕保护程序，空闲超时和其他方法中使用密码保护，以减轻此问题中固有的安全问题。
HTTP代理是中间人，代表了中间人攻击的机会。代理可以访问安全相关信息，个人用户和组织的个人信息以及属于用户和内容提供商的专有信息。
代理运算符应保护代理运行的系统，因为它们将保护包含或传输敏感信息的任何系统。
缓存代理提供了额外的潜在漏洞，因为缓存的内容代表恶意攻击的有吸引力的目标。因此，缓存内容应该被保护为敏感信息。
