I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not to use https for the communication between both servers internally (using localhost)? This way I'd only need to install the certificate at the reverse proxy level.
3 Answers
Since the traffic only goes to localhost, it's all handled by the loopback adapter and will never reach the network. As a result, using plain HTTP is fine.
If you wish to use HTTPS, in case that the servers will one day be separated, you can create a self-signed certificate for localhost and manually mark it as a trusted leaf certificate, even with no root CA. In practice, it will likely not make a difference.
-
Thanks! So, for completeness sake, if the services were on different servers (same network) the suggestions would be to always use https?– MikeCommented Oct 23, 2019 at 14:00
-
Absolutely. While you may argue that it's more difficult to exploit, HTTPS makes it more difficult for an attacker inside your network (e.g. a compromised employee machine) to read and modify data.– user163495Commented Oct 23, 2019 at 14:03
No, it is not acceptable.
In many cases communication within The OAuth 2.0 Authorization Framework TLS is shown a "MUST" (required) or "SHOULD" (which implies RECOMMENDED)
The server machine on which the resource server and authorization server are both running, possibly could be compromised, whereas it is possible that the resource server and authorization software are running with various protections (e.g., they each create a virtual machine with various mechanisms to hide data in memory, etc.), which protect them for a compromised server machine that they are running in. Then http comms between the 2 servers could be the weak point where an attacker could succeed in eavesdropping and other attacks.
localhost)