CODEWITHSUNDEEP
linuxnetwork-programmingwebhttps
danday74
danday74

Reputation: 57205

Do all servers need to use the HTTPS protocol or just public facing servers?

I have a front end web server running over HTTPS - this is public facing - i.e. port is open.

I also have a backend API server that my webserver makes API requests to - this is public facing and requires authentication - port is open.

These 2 servers run over HTTPS.

Behind the API server, there are lots of other servers. The API server reverse proxies to these servers. Ports for these other servers are not open to incoming traffic. They can only be talked to via the API server.

My Question ... Do the "lots of other servers" need to run over HTTPS or, given that they cannot be accessed externally, can they run over HTTP safely instead?

I thought this would be a common question but I could not find an answer to it. Thanks. If this is a dupe please point me to the right answer.

Upvotes: 1

Views: 81

Answers (2)

Tom
Tom

Reputation: 4846

TL;DR you should encrypt the traffic unless it's on the same host.

You can't trust your network. Malwares in your own network can intercept/modify http requests.

It's not theoretical attacks, but real life example:

Upvotes: 2

hek2mgl
hek2mgl

Reputation: 158170

The question is how much do you trust the connection between the public IP and the backend server?

If it is not your data center, at least any privileged employee of the ISP could see/change the data. I guess that's not something your customers would like to hear.

If it is your data center, meaning you are a kind of ISP still everybody who has physical access to the data center can potentially sniff the clear text traffic. Or in general, anybody who has access to the wire can see the traffic, it is much harder to implement a strict access control in your company.

Upvotes: 1

Related Questions