Timeline for Securing REST API without HTTPS
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 12, 2015 at 23:56 | vote | accept | Aaron D | ||
| Jul 12, 2015 at 22:18 | answer | added | Andrey | timeline score: 2 | |
| Jul 12, 2015 at 20:57 | history | edited | Aaron D | CC BY-SA 3.0 |
Added more information about the situation, rearranged things, formatting
|
| Jul 12, 2015 at 17:16 | answer | added | Gerald Davis | timeline score: 1 | |
| Jul 12, 2015 at 16:59 | answer | added | Shritam Bhowmick | timeline score: 0 | |
| Jul 12, 2015 at 14:31 | history | edited | Aaron D | CC BY-SA 3.0 |
Added information about why I think a shared secret is insufficient
|
| Jul 12, 2015 at 4:35 | history | tweeted | twitter.com/#!/StackSecurity/status/620088950686941184 | ||
| Jul 12, 2015 at 3:29 | comment | added | Aaron D | Both ports should be accessible, but only to those on the LAN. All inbound traffic from the Internet is blocked - it's an intranet-only server. | |
| Jul 12, 2015 at 2:13 | comment | added | Neil McGuigan | They allow port 80 but not 443? | |
| Jul 12, 2015 at 0:42 | comment | added | Aaron D | The webserver in question is behind a firewall that denies inward access (so is only accessible on the LAN). The network/firewall administrators refuse to provide a signed certificate for my server, and a Let's Encrypt certificate would require access through the firewall (which I don't have). That limits me to self-signing, which causes certificate errors on client browsers - something I'd rather avoid - or paying for a certificate, which is overkill for this point in the project. I'm sure in the future I'll be able to use HTTPS but for now, I'd like to know if I can secure my API without it. | |
| Jul 11, 2015 at 20:26 | comment | added | Neil McGuigan | Why can't you use HTTPS? | |
| Jul 11, 2015 at 16:04 | answer | added | ieatpizza | timeline score: 4 | |
| Jul 11, 2015 at 13:31 | history | asked | Aaron D | CC BY-SA 3.0 |