I have a REST HTTP server listen on localhost port and a HTTP client runs locally and talks with the server. The client could send sensitive info (credential etc) to server and the credential is encrypted/decrypted by Windows API.
In this case, do I need to wrap the HTTP server with SSL (to be HTTPS server)?
No. Its not neccessary at all. First, because packet capturing/modifying requires administrator rights. But second, with administrator rights, you are aswell able to modify other processes that you don't own, thus can modify/read the RAM for the client or server before the data is encrypted by the SSL layer, or after its decrypted by the SSL layer.
Thus SSL will neither contribute or compromise anything security-wise, it will have zero effect. It may have effect on performance.
Also, since the private key for the certificate needs to be stored on the very same machine, the attacker could steal that key and use it to read/modify the local traffic.
So SSL will just only make debugging harder and add nothing.
It's worth keeping in mind that just because a server is bound to the loopback interface does not preclude malicious code from making requests of the server from elsewhere on your computer even without administrative access to sniff the traffic of other clients interacting with the server. See the round of vulnerabilities called out late last year: http://www.pcworld.com/article/3012061/security/vulnerabilities-found-in-lenovo-toshiba-dell-support-software.html
This doesn't mean you need SSL/TLS; it means you should keep this in mind when designing the local server.
