CODEWITHSUNDEEP
ssl
Rohit Chatterjee
Rohit Chatterjee

Reputation: 3107

SSL for statically served web application

I'm building a serverless web application. My HTML, CSS and JavaScript are in a public storage location which my domain example.com points towards.

When my users navigate to my domain using their browser, their browser will GET these files from that location and then there is no further communication with example.com. The JavaScript application runs in the browser and communicates with a separate backend via HTTPS (in my case AWS, but could be e.g. Azure, Kinvey, BlueMix or others).

It therefore seems to be that there is no reason to encrypt the communication between my users' web browsers and xyz.com i.e. I don't need to provide https://example.com, and my doing so would provide no security benefit.

Am I correct?

The reason I ask is that I found at least two static hosting services which offer SSL support:

I am aware of the reasons for wanting HTTPS (described in the second link above and also at https://levels.io/default-to-https/ ...) but none of this seems to apply to my situation.

I believe this is a serious question because more applications will be built in this manner (the folks at http://serverlessconf.io/ certainly think so), and as long as the channel to the actual backend is secured there is no reason to secure the channel to what is essentially a read-only hard disk.

Upvotes: 0

Views: 47

Answers (1)

Frederick Cheung
Frederick Cheung

Reputation: 84132

If you don't secure communication with example.com then a man in the middle attacker (eg a rogue wifi hotspot) could modify the html and JavaScript loaded by users.

One way to use this would be to change the JavaScript so that subsequent API requests are sent to attacker controller servers instead of yours, compromising any credentials or information transferred.

Upvotes: 1

Related Questions