Preface: We're running an API back end with JS-framework front end for our website. They will be running on the same box and we have no need for the API to be available via a publicly exposed hostname.

That being said, if we're using this in production, is it superfluous (security-wise) to use TLS for our localhost application? For the sake of being thorough, let's assume that the LAN is not secure. However, we do have a hardware and software firewall on our LAN.


Yes, because localhost traffic doesn't go over the network. There's a special loop back adapter in operating systems that handle requests to Using TLS on localhost would simply add an extra layer of encryption on memory that doesn't ever leave the box.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.