HTTPS effectively encrypts HTTP traffic during transport and is a tried-and-trusted method for securing HTTP traffic from prying eyes.
However, with emerging solutions for web applications that include the analysis of HTTP traffic, like Web Application Firewalls (WAFs) or specific load balancing schemes, HTTPS traffic is often broken up and analyzed by intermediary systems. These intermediary systems are now a new threat to the end-to-end security of HTTP content. Many solutions are available to address this problem by securing specific parts of HTTP traffic.
This project aims to provide an overview of the current state of the art, categorize different approaches, and develop guidelines for practitioners on when to use which technology effectively.