CODEWITHSUNDEEP
pythondjangoapirestsecurity
user1800356
user1800356

Reputation: 305

Django rest Framework : encrypt response data

I am using Django rest Framework to build a REST API for one of my clients. The app provides some sensitive information such as passwords when the client asks for it through an API call.

Now, only authorized clients can access to the app and besides that, only authorized IP can connect.

But what if someone was listening in the middle of that connection ? He would see all the datas in clear.

Is there a way to encrypt those info, maybe with a password, and then decrypt it when it arrives ? (the client would have to update his app, but it's not a problem).

I was thinking maybe to create an "EncryptedResponse" instead of "Response" in my django app.

Thanks

Upvotes: 0

Views: 5120

Answers (1)

tdsymonds
tdsymonds

Reputation: 1709

If you don't have one already, purchase an SSL certificate and configure your site to load the API over HTTPS. That way the connection between the authorized client and your application would be encrypted which will prevent a man in the middle attack that you're describing.

If you're not going to load the API over HTTPS, then the authentication token, or API key, or whatever you're using to authenticate the client can also be intercepted.

However, if you're looking to stick to the encrypting the data route, I've found this guide that looks like it should help you be able do what you need to do:

http://gpiot.com/blog/encrypted-fields-pythondjango-keyczar/

Upvotes: 4

Related Questions