1

I'm building an application which stands alone for the most part, but which needs to access another system for private user data.

What is a simple and safe method of securing that private data? We would like to make sure that only my known server can access the API.

3

There are many possibilities to enhance the security:

  • use HTTPS for transport encryption
  • authenticate with an API key
  • only allow connections from specific IP addresses
  • use certificate pinning (store the server's public key fingerprint and compare it when connecting to prevent MITM)
  • isolate the two servers from the rest of the network or the internet

As always, there won't be perfect security and you have to decide on how much effort you want to put into securing your data depending on your threat assessment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.