I have implemented my product's HTTP(REST) API as a public API. Although my server only allows HTTPS, I don't have any control over the clients. I have vendors implementing clients to my API, and I am wondering if there is any kind of way to protect their end-costumers who will use the vendor's client to communicate with my system - so that the vendor will not be able to use the end-costumer data?

  • Is there any reason you can't simply disable HTTP requests and only accept HTTPS requests? Then the vendors' clients wouldn't work unless they used HTTPS. That wouldn't prevent the client from seeing the data though, that's not really possible. – AndrolGenhald Aug 2 '18 at 20:00
  • @AndrolGenhald - HTTP is disabled. this wasn't the question. The question is - is there a way to enforce the client to use some "end to end encryption" style solution - where I am sure that even if the vendor is proxying the client's request to me through their "vendor data collection server" - the part that calls my API will be protected from that 3rd party vendor – Yoav R. Aug 2 '18 at 20:04
  • Sorry, it sounded to me like you implemented an HTTP REST api that works both over HTTP and HTTPS – AndrolGenhald Aug 2 '18 at 20:06
  • @AndrolGenhald - In other words - I want to know if there is a way to protect my end-costumers from the vendor who supplies the client. I have a service that ultimately supposed to serve end-costumers, but from business point of view - I am not the one who "brings" the end-costumer to use my product - This is the 3rd party vendor's job. – Yoav R. Aug 2 '18 at 20:09

You have the control over what you are serving to the client. This means that if you don't trust your vendor who provides the client then you face the fact that the vendor can see the data your API is transmitting for the client.
The vendor can do anything with that data.
In order to mitigate that, you can do the following:

  1. Use a legal contract that covers this concern, you can't control the vendor client
  2. Encrypt the payload with a key that the only user knows, but that is probably unlikely that the user will have to decrypt/encrypt the traffic, bad user experience.
  3. Take control over the client or at least audit the code per version

As an API, you can only guarantee how the data and which data is delivered, you can't control over the processing of that data on the client side.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.