8

I develop applications on my local computer that I later deploy to a TLS production server. Should I develop with TLS on or off?

Improve this question
1
  • 1
    Security is not a product but a process. It is better to start by taking into account security measures right at the beginning instead of trying to bolt them on afterwards. Some interesting reading about TLS in applications outside of the web realm and some frequent errors: cs.utexas.edu/~shmat/shmat_ccs12.pdf
    – Patrick Mevzek
    May 30, 2018 at 23:14

1 Answer 1

Reset to default
13

The answer is simple - yeah, dev using TLS. Here's why:

  1. You need to set the secure flag on cookies
  2. You want to make sure all resources accessed are https
  3. You might forget to turn on TLS dependencies when you deploy your code to production
  4. It's easy to do this. Go use acme.sh to register a let's encrypt cert using DNS for domain verification. Create a DNS A record that points to 127.0.0.1. Done.
  5. Don't use self signed certs because I don't want you forming a habit of clicking past TLS warnings

If you really really don't want to....

Then you need a post deploy compensating control. That means scan your website looking for TLS dependancies like the cookie secure flag. Use qualys free scanner to probe your site for issues like this.

Improve this answer
18
  • 1
    I myself could likely do this, though I work in an extremely free environment. When I worked for a Fortune 100 company however, there's no way I could have done this.
    – Steve Sether
    May 30, 2018 at 21:19
  • 2
    "Create a DNS A record that points to 127.0.0.1. Done." this is exactly NOT recommended by Let's Encrypt, see: letsencrypt.org/docs/certificates-for-localhost. Self-signed certificates are completely fine for local development. They are not a bad habit per se. The bad habit is not checking the issuer of a certificate and not acting correctly upon it.
    – Patrick Mevzek
    May 30, 2018 at 23:13
  • 1
    @SteveSether nothing prevents you to buy a domain name (so that you are sure they will be no collision) let us say example.com and then just use locally (/etc/hosts, dnsmasq, bind views, etc...) whatever name you fancy, like dev.example.com. Making it that way makes sure you do not create false assumptions that would stick more or less consciously when you release the work in the wild...
    – Patrick Mevzek
    May 30, 2018 at 23:23
  • 1
    @PatrickMevzek I read their advice and agree with it. Do not ship an app with a cert for a local host. Nothing suggests you can’t develop using one and I personally prefer teaching staff no exceptions to the bypass tls warnings. I disagree with adding Certs to a trusted store because they get forgotten.
    – Jonathan
    May 30, 2018 at 23:39
  • 1
    @SteveSether quoting the page: "Sometimes people want to get a certificate for the hostname “localhost”, either for use in local development, or for distribution with a native application that needs to communicate with a web application. Let’s Encrypt can’t provide certificates for “localhost” because nobody uniquely owns it, and it’s not rooted in a top level domain like “.com” or “.net”. It’s possible to set up your own domain name that happens to resolve to 127.0.0.1, and get a certificate for it using the DNS challenge. However, this is generally a bad idea and there are better options."
    – Patrick Mevzek
    May 30, 2018 at 23:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .