I have a resource server (REST API) and an authorization server which are installed on the same server and behind a reverse proxy. All incoming external requests use https. Would it be acceptable not to use https for the communication between both servers internally (using localhost)? This way I'd only need to install the certificate at the reverse proxy level.
Since the traffic only goes to
localhost, it's all handled by the loopback adapter and will never reach the network. As a result, using plain HTTP is fine.
If you wish to use HTTPS, in case that the servers will one day be separated, you can create a self-signed certificate for
localhost and manually mark it as a trusted leaf certificate, even with no root CA. In practice, it will likely not make a difference.
No, it is not acceptable.
In many cases communication within The OAuth 2.0 Authorization Framework TLS is shown a "MUST" (required) or "SHOULD" (which implies RECOMMENDED)
The server machine on which the resource server and authorization server are both running, possibly could be compromised, whereas it is possible that the resource server and authorization software are running with various protections (e.g., they each create a virtual machine with various mechanisms to hide data in memory, etc.), which protect them for a compromised server machine that they are running in. Then http comms between the 2 servers could be the weak point where an attacker could succeed in eavesdropping and other attacks.