7

We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2.

We are investigating moving to HTTP/2 for bandwidth & performance requirements. HTTP/2 standard has no implementation for client certificate authentication.

We still want an extra layer next to the bearer token authentication. What are valid and secure options to explore to harden our API?

Adding a nonce is a possible solution to block malicious requests, but we would like to limit public access to our API.

Improve this question
3
  • How about using regular HTTPS for token management and switching to HTTP/2 for everything else?
    – Stephane
    Commented Jun 13, 2018 at 6:58
  • Azure App Service enables/disable client certification on the full API. This would mean having an App Service for token managment and a different App Service for the API. Not solving the issue of the API being exposed on the public internet without the need of anything, to explore or perform malicious requests.
    – Preben Huybrechts
    Commented Jun 13, 2018 at 7:03
  • Your API will need to perform authentication anyway. If you require a session token that can only be obtained through your token management interface (through HTTPS+TLS) then you do reach the same functional goal. It true, however, that a connection must reach your application before being rejected instead of being rejected at the connection level. This does increase your attack surface somewhat
    – Stephane
    Commented Jun 13, 2018 at 12:11

2 Answers 2

Reset to default
2

Use a separate subdomain that requires a client certificate. It's only renegotiation that's not allowed, so if you ask for a client certificate at the beginning of an HTTP/2 TLS session it will still work.

Improve this answer
0

We solved this by using Azure App Service IP restrictions. This was only possible because we control all the clients.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .