CODEWITHSUNDEEP
httpsslhttpsgrpctls1.2
Lei Yang
Lei Yang

Reputation: 4325

grpc - is TLS necessary if https enabled?

I'm newbie of grpc and have played with simple grpc clients of java, go, and python. I know basic http and https but not familiar with protocal details. So this question may be rediculous to you but I didn't find any explaination online.

I know grpc has insecure(go: grpc.WithInsecure(), python: grpc.insecure_channel, java: usePlaintext()) and secure mode(TLS). and grpc is based on httpv2, and http has security mode(https).

So what if use insecure grpc with https? Is the overall data transfer safe?

And what if use TLS grpc with https? Is there performance overhead(becuase I think the messages are encrypted twice)?

Thank you for any answer, any exsiting webpages explaining such topic that will be best!

Upvotes: 4

Views: 6229

Answers (2)

Jake Muller
Jake Muller

Reputation: 1063

Using gRPC over TLS is highly recommended if you gRPC server is serving requests coming from outside(external network). For example you're creating front end app in javascript serving user requests. Your javascript app make call to your gRPC server for APIs your server provide. Your javascript communicate to your gRPC server through stub created in javascript end. At the end of your gRPC server, you need to set tls mechanism to secure communication between your javascript app and your gRPC server(because requests coming from outside).

gRPC somehow mostly used for internal services communication inside internal network in microservice architecture. You don't need to set tls for internal network usage since requests coming from your own environment from within your watch.

If you want to apply something like "gRPC over HTTPS", then you need something like gateway to map your http call to your gRPC server. Check this out.

You need to compile your proto file as gateway service definitions as well using provided tools. Now you can create your normal http server with tls enabled through something like http.ListenAndServeTLS(...). Dont forget to register your grpc server to the http server using the service definitions compiled from the proto file. With this all your requests to are encrypted with tls to your http server like normal rest apis do, but get proxied to gRPC server you defined. There's no need to enable tls at your gRPC server since it has been enabled in your http server.

Upvotes: 3

Eric Anderson
Eric Anderson

Reputation: 26394

Insecure implies http. And TLS implies https. So there's no way "to use insecure grpc with https", as at that point it is then http.

There is no double-encryption. The gRPC security mode is the same as the HTTP security mode.

Upvotes: 6

Related Questions