1

There is an authentication server (OAuth2) that is only accessible from private network. A customer wants me to implement an app where users use VPN to authenticate themselves on such a server via HTTP (specifically not HTTPS) I am not a security expert, but have a bad feeling about this. Is it safe? If not, what are the dangers of this approach?

Note: The app will be running on Android devices

Improve this question
8
  • So that'd be HTTP over an encrypted VPN tunnel?
    – Tangui
    Commented Sep 25, 2019 at 7:52
  • I have to ask, why not HTTPS?
    – user163495
    Commented Sep 25, 2019 at 7:57
  • @Tangui Yes, that's correct
    – Jan Málek
    Commented Sep 25, 2019 at 8:07
  • @MechMK1 They say it's secure because they are using the VPN, I don't think so, but I am not so sure and that's why I am here. I will try to make them use HTTPS when I have arguments to work with.
    – Jan Málek
    Commented Sep 25, 2019 at 8:07
  • 2
    That's still not a good point against it. A VPN is just an encrypted tunnel to your network. Even internal applications should be secured with HTTPS, or else everybody in your network (including an attacker) can read and modify all the traffic to and from the application. And again, why not HTTPS? It costs literally nothing, and the computational overhead is completely negligible these days.
    – user163495
    Commented Sep 25, 2019 at 8:10

1 Answer 1

Reset to default
0

If you consider that the network between the VPN's endpoint and the OAuth2 server is safe (because request are reencrypted, or it's a "trusted network"), then an HTTPS tunnel or a VPN tunnel offers the same level of security (encryption and authentication).

However, as stated in section 3.1.2.1 of the OAuth2 RFC:

The redirection endpoint SHOULD require the use of TLS as described in Section 1.6 when the requested response type is "code" or "token", or when the redirection request will result in the transmission of
sensitive credentials over an open network.

So it's highly recommended to have the OAuth2 server protected with TLS. If it's not, some credentials could be intercepted on the local network of the company in case of misconfiguration of some network equipment.

Also not that OAuth2 expect to have TLS everywhere, so some things can actually not work. For instance, some libraries could refuse to use some endpoints of /.well-known/openid-configuration if it's not HTTPS.

So: it's highly recommended to enable HTTPS on your OAuth2 server, but in your case it is not mandatory.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .