Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption.

The server recieves POST request with two parameters:

  1. Action (int value)
  2. Data (base 64 encoded)

If action is valid then the data gets base64 decoded. The result string then gets decrypted by the openssl_private_decrypt() php function. The decrypted string is in JSON format.

Is it really needed to have the SSL function if my server already has a certificate? Can I just send the JSON in plain text via the data parameter in the POST request, making it safe for my users to send sensitive data?

  • 1) What do you mean by Is it really needed to have the ssl function if my server already has a certificate ? How are you using the certificate, if not via ssl / tls? 2) You don't care about encrypting the action (int value) or the HTTP headers? Often HTTP headers contain sensitive info like auth tokens. Jan 22 '20 at 18:53
  • @MikeOunsworth Pretty sure he's wondering about the usefulness of encrypting the application's json payload when it's already traveling over HTTPS.
    – user
    Jan 22 '20 at 19:19
  • Oh I see. Yeah, I assumed the question was about removing the SSL layer because they are doing manual decryption. If the question is about removing the openssl decryption of the data param, then my answer below does not apply :P Jan 22 '20 at 19:26
  • Yes thats my question... I didn't formulated the best way I could... :) so is it really necessary? Jan 22 '20 at 19:43

EDIT: I misunderstood the question, original answer below

Standard HTTPS will protect everything from evesdroppers on the network; the POST data, any HTTP headers, cookies, even the URL that they are accessing.

If your site has standard HTTPS, then you do not need extra encryption of the content. Yes, you can remove that extra call to openssl_private_decrypt().

Original answer

Even if you're encrypting the content of your POST bodies, what about the rest of the HTTP message?

Here's a sample GET for loading this page (all cookie values changed to X)

GET /questions/224647/unnecessary-ssl-encryption-in-api HTTP/1.1
Host: security.stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://security.stackexchange.com/
Connection: close
Cookie: prov=X
__utmt=1; _ga=GA1.X; _gid=GA1.X
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

If the HTTP headers on your API include sensitive information like the user's IP address, user agent, auth token, cookies, even which URL they are accessing is sometimes considered sensitive, then you need TLS / SSL to encrypt that.

  • Ok, im understanding... My site has https, a stardar ssl certificate, securing the communication between browser and server... And im also encrypting the content of the post request. Im thinking that the ssl cert will handle the headers and also the post content from packet capture... Am i correct?... If so... is it really usefull to encrypt the content of the post request... If I am wrong, how should I resolve these issues? Jan 22 '20 at 19:31
  • Ah ok, I understood your question backwards. If you have standard HTTPS, then you do not need extra encryption of the content. Yes, you can remove that extra call to openssl_private_decrypt(). Jan 22 '20 at 19:42
  • 1
    Marking your question as correct! Still have some doubts about sanitizing user input but thats for another question! Thanks! Jan 22 '20 at 19:49
  • @a161803398874 depends on what you mean by "sanitizing". You still have to check the input to make sure it makes sense, and process it in a safe way. The golden rule here is to never trust user input. Encryption does nothing to change that reality - neither SSL nor your own custom encryption scheme will stop a malicious user from injecting dangerous data into your application. Jan 22 '20 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.