Timeline for Securing REST API without sending or storing clear credentials
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 17, 2015 at 15:37 | vote | accept | Cyrbil | ||
| Jul 15, 2015 at 7:41 | comment | added | Cyrbil | @DavidScholefield: "Both the client and the server will be aware of this". How is the server aware of it and is it advisable to refuse connection in this scenario ? | |
| Jul 13, 2015 at 19:52 | comment | added | Craig Tullis | @DavidScholefield One catch or exception is that if you are on a workplace computer and your IT department has enabled SSL inspection in your firewall, and installed the certificate from the firewall into the certificate stores on all the workstations (using Group Policy or some other method), the client will accept the proxied connections without protesting, and the firewall can indeed then intercept and log the cleartext of your HTTPS session. | |
| Jul 13, 2015 at 17:02 | answer | added | mcgyver5 | timeline score: 3 | |
| Jul 13, 2015 at 16:42 | comment | added | David Scholefield | What you are missing is that the client-to-server HTTPS connection will have to terminate at the proxy and the proxy will then have to create a new HTTPS connection to the server. Both the client and the server will be aware of this and as long as you have configured the client and server correctly (default for most systems) the client will protest because the endpoint (proxy) will not match the device registered to the SSL certificate identifying the server. | |
| Jul 13, 2015 at 15:19 | comment | added | Cyrbil | What part of ssl am I missing ? One could easily setup an ssl proxy and observe https traffic. I have seen it for many mobile application and seen used to get token and credentials.. | |
| Jul 13, 2015 at 15:13 | comment | added | mcgyver5 | part of the purpose of ssl/tls (https) is to not send credentials in the clear. When working, it defeats mitm. | |
| Jul 13, 2015 at 15:10 | comment | added | Cyrbil | Credentials will be sent in clear through the ssl connection. Maybe this is a misunderstanding from myself, but doesn't this makes it vulnerable if someone use mitm attack ? | |
| Jul 13, 2015 at 15:09 | history | edited | S.L. Barth is on codidact.com | CC BY-SA 3.0 |
added 1 character in body
|
| Jul 13, 2015 at 15:05 | comment | added | mcgyver5 | https will not send clear credentials. how will someone sniff one https request to get key? | |
| Jul 13, 2015 at 15:00 | history | edited | S.L. Barth is on codidact.com | CC BY-SA 3.0 |
added 23 characters in body; edited title
|
| Jul 13, 2015 at 14:52 | review | First posts | |||
| Jul 13, 2015 at 15:00 | |||||
| Jul 13, 2015 at 14:52 | history | asked | Cyrbil | CC BY-SA 3.0 |