7

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B.

Each domain has a different system that will communicate with the other using API. I'm wondering what would be the risks if I didn't use SSL/TLS connection for the API calls?

If I restricted access to API calls to 127.0.0.1 and the above IPs only, will it be still possible for an attacker to hijack transmitted information? Can he spoof the IP to appear using the server's IP and then steal the information?

5

Traffic to the loopback address (127.0.0.1) will not leave the machine it is on, and is thus secure if your server is secure.

If your two example IP addresses point to the same server, your server should recognize this and again prevent traffic from leaving the server.

However, if those IP addresses are for different servers, there is a possibility for an intercept of the data as it flows across the network. This risk might be somewhat mitigated if the servers are on the same private network or in the same datacenter. SSL/TLS can help protect against this.

Restricting API access to specific IP addresses is a good strategy of reducing the risk of unwanted data access, but it does not eliminate it. As I mentioned, traffic interception is still a risk if the network traffic is unencrypted.

Also, with regard to spoofing, it depends on the exact protocol you are using. Protocols using TCP (HTTP is performed over TCP in the standard case), have some resistance to IP address spoofing, but there are still attacks that allow for IP address spoofing in some circumstances.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.