3

I have the following problem:

A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In front of the REST API is a web server (nginx) acting as a proxy. It is also used for load balancing. Both connections, from the clients to the web server and from the web server to the REST API are over TLS (1.2 and 1.3).

I wonder if this is sufficient for the interchange of confidential data. As I unterstand this means that there is no end to end encryption in this case. So data may be accessed from unauthorized actors at least at the web server.

If not, how to secure the interchange? Of course, I can use a symmetric encryption scheme to encrypt the data between clients and REST API and an asymmetric one for the shared key. But this smells like building my own crypto to me and leads to the problem of the certificate distribution.

6
  • If you don't trust your own webserver, your clients should not trust it either.
    – ThoriumBR
    May 12, 2022 at 11:56
  • Thank you, so the approach would be valid if I can trust the webserver?
    – Frederik
    May 12, 2022 at 12:57
  • Since all connections are over TLS, I see no problem in confidentiality of messages. One thing that can be considered is: in case connection between API service and server is no longer trusted, a replay attack can be applied. maybe you can consider that in your model. May 12, 2022 at 13:17
  • Thank you. Can you further explain the scenario with the no longer trusted connection, please?
    – Frederik
    May 12, 2022 at 15:42
  • I dont know if server and API service is running in same location but let's say someone keeps repeating the messages sent from server to API service. May 12, 2022 at 16:07

1 Answer 1

1

I think that the only missing part is the traffic between your nginx and your backends. In general, this is handling by using your own certificates and mTLS, so you have your connections from users/apps to your nginx with a public certificate with TLS 1.2 or 1.3, and for your internal connections (from your nginx to your databases) you have private/self certificates (you can manage them) that you have control of them and dont need to face internet basically.

Remember that this is a basic approach and you should research of how is the best model for you.

Hope it helps

1
  • Thank you, the use of mTLS might be a good idea, I will think about it. But it misses my point: I know that both connections (client and nginx, nginx and REST API) should be encrypted and will be. My concern is that the connection over TLS will be terminated at the nginx so there is no end to end encryption from client to REST API.
    – Frederik
    May 12, 2022 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .