Quickly and easily convert any URL or raw HTML into a high-quality PDF. You can use our REST API in any programming language and it comes packed with many options for different layouts, headers and footers, watermarking, encryption and much more. Show
The HTML5 History API is definitely the way to go for modern websites. It accomplishes the task at hand, while also providing additional functionality. You can use either The arguments for both methods are the same, allowing you to pass a customized serializable Using the Location APIThe older Location API is not the best tool for the job. It reloads the page, but still allows you to modify the current URL and might be useful when working with legacy browsers. You can modify the URL, using either As you can see, all three options will cause a page reload, which can be undesirable. Unlike the History API, you can only set the URL, without any additional arguments. Finally, the Location API doesn't restrict you to same-origin URLs, which can cause security issues if you are not careful. This section uses the openssl command-line program, which comes with most Linux, BSD, and Mac OS X systems, to generate private/public keys and a CSR. Generate a public/private key pairLet's start by generating a 2,048-bit RSA key pair. A smaller key, such as 1,024 bits, is insufficiently resistant to brute-force guessing attacks. A larger key, such as 4,096 bits, is overkill. Over time, key sizes increase as computer processing gets cheaper. 2,048 is currently the sweet spot. The command to generate the RSA key pair is:
This gives the following output:
Generate a certificate signing requestIn this step, you embed your public key and information about your organization and your website into a certificate signing request or CSR. The openssl command interactively asks you for the required metadata. Running the following command:
Outputs the following:
To ensure the validity of the CSR, run this command:
And the response should look like this:
Submit your CSR to a certificate authorityDifferent certificate authorities (CAs) require different methods for sending them your CSRs. Methods may include using a form on their website, sending the CSR by email, or something else. Some CAs (or their resellers) may even automate some or all of the process (including, in some cases, key pair and CSR generation). Send the CSR to your CA, and follow their instructions to receive your final certificate or certificate chain. Different CAs charge different amounts of money for the service of vouching for your public key. There are also options for mapping your key to more than one DNS name, including several distinct names (e.g. all of example.com, www.example.com, example.net, and www.example.net) or "wildcard" names such as *.example.com. For example, one CA currently offers these prices:
At these prices, wildcard certificates are economical when you have more than 9 subdomains; otherwise, you can just buy one or more single-name certificates. (If you have more than, say, five subdomains, you might find a wildcard certificate more convenient when you come to enable HTTPS on your servers.) Keep in mind that in wildcard certificates the wildcard applies to only one DNS label. A certificate good for *.example.com will work for foo.example.com and bar.example.com, but not for foo.bar.example.com. Copy the certificates to all your front-end servers in a non-web-accessible place such as 0 (Linux and Unix) or wherever IIS (Windows) requires them.Enable HTTPS on your serversEnabling HTTPS on your servers is a critical step in providing security for your web pages.
At this point, you must make a crucial operations decision. Choose one of the following:
If you have been using distinct IP addresses for each hostname, you can easily support both HTTP and HTTPS for all clients. However, most site operators use name-based virtual hosting to conserve IP addresses and because it's more convenient in general. The problem with IE on Windows XP and Android earlier than 2.3 is that they do not understand Server Name Indication (SNI), which is crucial for HTTPS name-based virtual hosting. Someday—hopefully soon—clients that don't support SNI will be replaced with modern software. Monitor the user agent string in your request logs to know when enough of your user population has migrated to modern software. (You can decide what your threshold is; perhaps < 5%, or < 1%.) If you don't already have HTTPS service available on your servers, enable it now (without redirecting HTTP to HTTPS; see below). Configure your web server to use the certificates you bought and installed. You might find Mozilla's handy configuration generator useful. If you have many hostnames/subdomains, they each need to use the right certificate. Warning If you've already completed these steps, but are using HTTPS for the sole purpose of redirecting clients back to HTTP, stop doing that now. See the next section to make sure HTTPS and HTTP work smoothly. Ultimately you should redirect HTTP requests to HTTPS and use HTTP Strict Transport Security (HSTS). However, this is not the right stage in the migration process to do that; see “Redirect HTTP To HTTPS” and “Turn On Strict Transport Security And Secure Cookies.” Now, and throughout your site's lifetime, check your HTTPS configuration with Qualys' handy SSL Server Test Your site should score an A or A+; treat anything that causes a lower grade as a bug. (Today's A is tomorrow's B, because attacks against algorithms and protocols are always improving!) Make intrasite URLs relativeNow that you are serving your site on both HTTP and HTTPS, things need to work as smoothly as possible, regardless of protocol. An important factor is using relative URLs for intrasite links. Make sure intrasite URLs and external URLs are agnostic to protocol; that is, make sure you use relative paths or leave out the protocol like 2.A problem arises when you serve a page via HTTPS that includes HTTP resources, known as mixed content. Browsers warn users that the full strength of HTTPS has been lost. In fact, in the case of active mixed content (script, plug-ins, CSS, iframes), browsers often simply won't load or execute the content at all, resulting in a broken page. And remember, it's perfectly OK to include HTTPS resources in an HTTP page. Key Term See Fixing Mixed Content for more details about ways to fix and prevent mixed content. Additionally, when you link to other pages in your site, users could get downgraded from HTTPS to HTTP. These problems happen when your pages include fully-qualified, intrasite URLs that use the http:// scheme. Don't We recommend you avoid using fully qualified intrasite URLs.
In other words, make intrasite URLs as relative as possible: either protocol-relative (lacking a protocol, starting with 3) or host-relative (starting with just the path, like 4).Do We recommend that you use relative intrasite URLs.
Do Or, you can use protocol-relative intrasite URLs.
Do We recommend that you use HTTPS URLs for intersite URLs (where possible).
Do this with a script, not by hand. If your site’s content is in a database, test your script on a development copy of your database. If your site’s content consists of simple files, test your script on a development copy of the files. Push the changes to production only after the changes pass QA, as normal. You can use Bram van Damme’s script or something similar to detect mixed content in your site. When linking to other sites (as opposed to including resources from them), don’t change the protocol since you don’t have control over how those sites operate. Success To make migration smoother for large sites, we recommend protocol-relative URLs. If you are not sure whether you can fully deploy HTTPS yet, forcing your site to use HTTPS for all sub-resources may backfire. There is likely to be a period of time in which HTTPS is new and weird for you, and the HTTP site must still work as well as ever. Over time, you’ll complete the migration and lock in HTTPS (see the next two sections). If your site depends on scripts, images, or other resources served from a third party, such as a CDN or jquery.com, you have two options:
Keep in mind that you also need to change intrasite URLs in your stylesheets, JavaScript, redirect rules, 5 tags, and CSP declarations, not just in the HTML pages.Redirect HTTP to HTTPSYou need to put a canonical link at the head of your page to tell search engines that HTTPS is the best way to get to your site. Set 6 tags in your pages. This helps search engines determine the best way to get to your site.Turn on Strict Transport Security and secure cookiesAt this point, you are ready to "lock in" the use of HTTPS.
First, use Strict Transport Security to tell clients that they should always connect to your server via HTTPS, even when following an 7 reference. This defeats attacks such as SSL Stripping, and also avoids the round-trip cost of the 8 that we enabled in .Clients that have noted your site as a known HSTS Host are likely to (such as an expired certificate). HSTS is explicitly designed this way to ensure that network attackers cannot trick clients into accessing the site without HTTPS. Do not enable HSTS until you are certain that your site operation is robust enough to avoid ever deploying HTTPS with certificate validation errors. Turn on HTTP Strict Transport Security (HSTS) by setting the 9 header. OWASP's HSTS page has links to instructions for various server software.Most web servers offer a similar ability to add custom headers. 0 is measured in seconds. You can start with low values and gradually increase the 0 as you become more comfortable operating an HTTPS-only site.It is also important to make sure that clients never send cookies (such as for authentication or site preferences) over HTTP. For example, if a user's authentication cookie were to be exposed in plain text, the security guarantee of their entire session would be destroyed—even if you have done everything else right! Therefore, change your web application to always set the Secure flag on cookies that it sets. This OWASP page explains how to set the Secure flag in several application frameworks. Every application framework has a way to set the flag. Most web servers offer a simple redirect feature. Use 2 to indicate to search engines and browsers that the HTTPS version is canonical, and redirect your users to the HTTPS version of your site from HTTP.Search rankingGoogle uses HTTPS as a positive search quality indicator. Google also publishes a guide for how to transfer, move, or migrate your site while maintaining its search rank. Bing also publishes guidelines for webmasters. PerformanceWhen the content and application layers are well-tuned (see Steve Souders' books for great advice), the remaining TLS performance concerns are generally small, relative to the overall cost of the application. Additionally, you can reduce and amortize those costs. (For great advice on TLS optimization and generally, see High Performance Browser Networking by Ilya Grigorik.) See also Ivan Ristic's OpenSSL Cookbook and Bulletproof SSL And TLS. In some cases, TLS can improve performance, mostly as a result of making HTTP/2 possible. Chris Palmer gave a talk on HTTPS and HTTP/2 performance at Chrome Dev Summit 2014. Referer headersWhen users follow links from your HTTPS site to other HTTP sites, user agents don't send the Referer header. If this is a problem, there are several ways to solve it:
Because search engines are migrating to HTTPS, in the future, you are likely to see more Referer headers when you migrate to HTTPS. Caution According to the , clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page is transferred with a secure protocol. Ad revenueSite operators that monetize their site by showing ads want to make sure that migrating to HTTPS does not reduce ad impressions. But due to mixed content security concerns, an HTTP 5 doesn't work in an HTTPS page. There is a tricky collective action problem here: until advertisers publish over HTTPS, site operators cannot migrate to HTTPS without losing ad revenue; but until site operators migrate to HTTPS, advertisers have little motivation to publish HTTPS.Advertisers should at least offer ad service via HTTPS (such as by completing the "Enable HTTPS on your servers" section on this page). Many already do. You should ask advertisers that do not serve HTTPS at all to at least start. You may wish to defer completing until enough advertisers interoperate properly. |