Let's set up the environment before coming to my question.
- We have an web application which will be accessible by browsers/clients over HTTPS.
- Monstly only accessible in the intranet ( rarely over the internet )
- Frontend using Angular
- Backend using Java-EE
Now I came to an argument with my colleagues over an concern of mine.
The communication between the frontend and backend is completely unencrypted, resulting in the credentials of a user logging in send over the intranet/internet completely clear text. Also they will enter sensitive data which is a secret of the company (ingredients, proportions, etc.).
Adding the fact we integraded LDAP Login possibility to our application this fact seems highly risky to me, possibly resulting in an entry point to gain more informations off the intranet (getting LDAP credentials and accessing more services and machines).
My colleagues said thats nothing to worry about since the communication between client and server is established over HTTPS.
However they couldn't convince me with only providing that one single argument at all, especially since there are known problems like SSL Stripping, MITM, or even traffic analysis. I know that I should only worry about those if we don't configure everything correctly, but thats also a concern of mine.
I am on the point that we should encrypt the communication betweeen client and server additionally with something like Jose4J. That would ensure that even in an intranet breach or HTTPS Problem the sensitive data would still be a secret. It would also be more hard to analyse the traffic.
Now I wanted to get an answer which provides more facts and a better conclusion than only "but we are using https".
Is only using HTTPS for an web application dealing with sensitive data "secure" enough?