2

I have a simple API that is used to send data back and forth between my two sites. This is not a public API that can be accessed by my clients, it is simply a service for the two sites to communicate. I use an API key to verify these requests, and I want to make sure that all my API requests are sent via SSL to protect my API key from man-in-the-middle attacks. Both sites have valid SSL certificates. I am using PHP with Laravel.

Right now, this is how I make the actual requests:

$call = "https://myapp.com/api/apikey/somedata";
$response = file_get_contents($call);

Note that the protocol in the url is https and that the data and api key are simply included in the url as segments.

My question is, is this approach enough to ensure that my api requests use HTTPS and can not be intercepted through a man-in-the-middle attack?

  • Which HTTPS client library are you using? The documentation there will tell you if it validates the security of the connection. (thereby preventing MitM attacks) In your code, we would need to know more about file_get_contents. I'm not a PHP programmer, so I'm not sure if that is your function (which we need to see contents of) or if it comes from a library? – Bryan Field Nov 14 '16 at 16:23
  • @GeorgeBailey file_get_contents is a native PHP function. I'm somewhat of a beginner with this stuff, can you elaborate on "HTTPS client library"? – Christian Nov 14 '16 at 16:29
  • The "HTTPS Client Library" is the Library (collection of code) which initiates the connection (as a client) to an HTTPS server. Since this is a native PHP function, then it part of a built-in library. – Bryan Field Nov 14 '16 at 16:35
3

As in any SSL connection, the system is secure if you use TLS 1.2 with only secure ciphers allowed (that is, good SSL configuration).

Other than that, SSL is MITM protected if the systems involved only trust the legitimate certificates used on the SSL connection. If one may inject on your truted certificate list or convince your system to accept a fake certificate, it will be able to do a MITM attack by presenting you the client the fake certificate, deciphering the data and reciphering it to your server, acting like a proxy.

So you may want to make sure you have trusted certificates correclty and restrictively set, and maybe also want to use public key pinning (explicitly deciding to trust specific public keys instead of fully trusting certificates or certificate authorities). You may want to check what are the trusted anchors that PHP is using, and it looks like depending on the version it may not even check the certificate at all, and that would make a MITM trivial. More info on that here: https://www.venditan.com/labs/2014/06/26/ssl-and-php-streams-part-1-you-are-doing-it-wrongtm/432

Note that the protocol in the url is https and that the data and api key are simply included in the url as segments.

I´m supposing you are worried that the API token would leak here because it is visible on the URL. Actually the api/apikey/somedata part is protected by SSL, what happens behind the scenes is that you stablish a SSL connection to myapp.com (without saying what you want from it on clear text) and then, just after sucessfully connected, using the protected and ciphered connection, you request to "get api/apikey/somedata". So the api key will not be visible for anyone listening. However, the full URL may leak by other channels, like a browser history, logs and so on. Thats why usually authentication tokens are added to HTTP headers instead of path or query params. They are as protected as in the path from the SSL point of view, but it less likely that it leaks by mistake.

  • 1
    Thanks for a great answer. I was concerned that the API token would leak through the URL, I'll look into adding it to the header. I'm still a bit confused about what you mean by "If one may inject on your trusted certificate list or convince your system to accept a fake certificate, it will be able to do a MITM attack". Right now, I don't have any sort of trusted certificate list, I assume this would be a list of sites that are allowed to connect to my server? – Christian Nov 14 '16 at 16:47
  • @Christian I´ve just improved my answer and I think it fits your comment. If still in doubt let me know. – CristianTM Nov 14 '16 at 16:53
  • Okay, after reading the article and doing some more reasearch I have a better understanding of how to ensure the SSL connection is secure. I still have a very basic question though. If I want to send a request to a site with SSL enabled, all I would need to do to ensure it uses the SSL connection would be to use https in the url, right? Like in my example. I'm confident that's how it works, but it's nice to have some confirmation :) – Christian Nov 14 '16 at 20:08
  • That will depend on the library system you are using. IM not sure how PHP deals with it But i would expect it to require SSL for https schema. – CristianTM Nov 14 '16 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.