8

I develop applications on my local computer that I later deploy to a TLS production server. Should I develop with TLS on or off?

1
  • 1
    Security is not a product but a process. It is better to start by taking into account security measures right at the beginning instead of trying to bolt them on afterwards. Some interesting reading about TLS in applications outside of the web realm and some frequent errors: cs.utexas.edu/~shmat/shmat_ccs12.pdf May 30, 2018 at 23:14

1 Answer 1

13

The answer is simple - yeah, dev using TLS. Here's why:

  1. You need to set the secure flag on cookies
  2. You want to make sure all resources accessed are https
  3. You might forget to turn on TLS dependencies when you deploy your code to production
  4. It's easy to do this. Go use acme.sh to register a let's encrypt cert using DNS for domain verification. Create a DNS A record that points to 127.0.0.1. Done.
  5. Don't use self signed certs because I don't want you forming a habit of clicking past TLS warnings

If you really really don't want to....

Then you need a post deploy compensating control. That means scan your website looking for TLS dependancies like the cookie secure flag. Use qualys free scanner to probe your site for issues like this.

17
  • 1
    I myself could likely do this, though I work in an extremely free environment. When I worked for a Fortune 100 company however, there's no way I could have done this. May 30, 2018 at 21:19
  • 1
    "Create a DNS A record that points to 127.0.0.1. Done." this is exactly NOT recommended by Let's Encrypt, see: letsencrypt.org/docs/certificates-for-localhost. Self-signed certificates are completely fine for local development. They are not a bad habit per se. The bad habit is not checking the issuer of a certificate and not acting correctly upon it. May 30, 2018 at 23:13
  • 1
    @SteveSether nothing prevents you to buy a domain name (so that you are sure they will be no collision) let us say example.com and then just use locally (/etc/hosts, dnsmasq, bind views, etc...) whatever name you fancy, like dev.example.com. Making it that way makes sure you do not create false assumptions that would stick more or less consciously when you release the work in the wild... May 30, 2018 at 23:23
  • 1
    @SteveSether quoting the page: "Sometimes people want to get a certificate for the hostname “localhost”, either for use in local development, or for distribution with a native application that needs to communicate with a web application. Let’s Encrypt can’t provide certificates for “localhost” because nobody uniquely owns it, and it’s not rooted in a top level domain like “.com” or “.net”. It’s possible to set up your own domain name that happens to resolve to 127.0.0.1, and get a certificate for it using the DNS challenge. However, this is generally a bad idea and there are better options." May 30, 2018 at 23:44
  • 1
    @SteveSether Domains can be found for a few dollars and Let's Encrypt delivers certificates for free. So I am not sure the finance is really the problem here... May 31, 2018 at 2:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.