mergesort
Reputation: 5197
Should I need to force HTTPS from a mobile app to API?
If my mobile app only makes requests using HTTPS to my API, do I need to worry about forcing HTTPS/disallowing HTTP requests?
Upvotes: 0
Views: 40
Answers (1)
ircmaxell
Reputation: 165201
Yes you do. TLS is susceptible to something known as a Downgrade Attack. So be sure to force it to be HTTPS using HSTS (HTTP Strict Transport Security) and disallowing normal HTTP requests in your application server.
Upvotes: 2
Related Questions
- How should I secure an API for use with a mobile app?
- REST APIs can be developed without HTTPS and JWT if consumed by Android Application only?
- Rest API security for mobile apps
- Will HTTPS API for a mobile app protect against Wireshark and similar?
- Included a HTTP (not HTTPS) URL link in my iOS App, do I need to disable App Transport Security?
- Does Apple require HTTPS from iOS Apps? 2018 Version
- Does iOS "app transport security enforcement“ mean I need to switch APIs to https?
- Security When Using REST API in an iPhone Application
- Mobile API Security Paradigm
- HTTPS - iPhone to API - Is URL secure?