If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required?

I can't find a lot of details online on this. It seems that OWASP mentions it's untrusted, but I don't know how could it be unsafe if it's not publically exposed. Also, every connection is secured with TLS. If it's untrusted, can someone explain why?

  • 2
    TLS, by default, provides privacy but not authentication - anybody can talk to you, and nobody can see what the two of you are saying. So just TLS doesn't mean the client is trusted in any way. If you have TLS with client authentication, then you have more assurance that the client is a trusted party, but OWASP is (reasonably) assuming that's not the case. – gowenfawr Sep 25 '17 at 12:35

Based on gowenfawr's comment and on some input from someone working in security, it seems like RMI is generally considered untrusted unless the connection is always both encrypted and authenticated.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.