How to ensure my API requests are sent using SSL

Question

I have a simple API that is used to send data back and forth between my two sites. This is not a public API that can be accessed by my clients, it is simply a service for the two sites to communicate. I use an API key to verify these requests, and I want to make sure that all my API requests are sent via SSL to protect my API key from man-in-the-middle attacks. Both sites have valid SSL certificates. I am using PHP with Laravel.

Right now, this is how I make the actual requests:

$call = "https://myapp.com/api/apikey/somedata";
$response = file_get_contents($call);

Note that the protocol in the url is https and that the data and api key are simply included in the url as segments.

My question is, is this approach enough to ensure that my api requests use HTTPS and can not be intercepted through a man-in-the-middle attack?

Answer 1

As in any SSL connection, the system is secure if you use TLS 1.2 with only secure ciphers allowed (that is, good SSL configuration).

Other than that, SSL is MITM protected if the systems involved only trust the legitimate certificates used on the SSL connection. If one may inject on your truted certificate list or convince your system to accept a fake certificate, it will be able to do a MITM attack by presenting you the client the fake certificate, deciphering the data and reciphering it to your server, acting like a proxy.

So you may want to make sure you have trusted certificates correclty and restrictively set, and maybe also want to use public key pinning (explicitly deciding to trust specific public keys instead of fully trusting certificates or certificate authorities). You may want to check what are the trusted anchors that PHP is using, and it looks like depending on the version it may not even check the certificate at all, and that would make a MITM trivial. More info on that here: https://www.venditan.com/labs/2014/06/26/ssl-and-php-streams-part-1-you-are-doing-it-wrongtm/432

Note that the protocol in the url is https and that the data and api key are simply included in the url as segments.

I´m supposing you are worried that the API token would leak here because it is visible on the URL. Actually the api/apikey/somedata part is protected by SSL, what happens behind the scenes is that you stablish a SSL connection to myapp.com (without saying what you want from it on clear text) and then, just after sucessfully connected, using the protected and ciphered connection, you request to "get api/apikey/somedata". So the api key will not be visible for anyone listening. However, the full URL may leak by other channels, like a browser history, logs and so on. Thats why usually authentication tokens are added to HTTP headers instead of path or query params. They are as protected as in the path from the SSL point of view, but it less likely that it leaks by mistake.