I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not to use https for the communication between both servers internally (using localhost)? This way I'd only need to install the certificate at the reverse proxy level.

  • Are both servers in the internal network, or on the same machine? (since you mentioned localhost) – MechMK1 Oct 23 '19 at 13:32
  • @MechMK1 from the question: "...which are installed on the same server..." – Mike Oct 23 '19 at 13:34
  • Sorry, been a long day. – MechMK1 Oct 23 '19 at 13:39

Since the traffic only goes to localhost, it's all handled by the loopback adapter and will never reach the network. As a result, using plain HTTP is fine.

If you wish to use HTTPS, in case that the servers will one day be separated, you can create a self-signed certificate for localhost and manually mark it as a trusted leaf certificate, even with no root CA. In practice, it will likely not make a difference.

  • Thanks! So, for completeness sake, if the services were on different servers (same network) the suggestions would be to always use https? – Mike Oct 23 '19 at 14:00
  • Absolutely. While you may argue that it's more difficult to exploit, HTTPS makes it more difficult for an attacker inside your network (e.g. a compromised employee machine) to read and modify data. – MechMK1 Oct 23 '19 at 14:03

No, it is not acceptable.

In many cases communication within The OAuth 2.0 Authorization Framework TLS is shown a "MUST" (required) or "SHOULD" (which implies RECOMMENDED)


The server machine on which the resource server and authorization server are both running, possibly could be compromised, whereas it is possible that the resource server and authorization software are running with various protections (e.g., they each create a virtual machine with various mechanisms to hide data in memory, etc.), which protect them for a compromised server machine that they are running in. Then http comms between the 2 servers could be the weak point where an attacker could succeed in eavesdropping and other attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.