For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific):
- Do I need to enable SSL (HTTPS) for this application or web server that hosts this application as well, or is it not needed in the end?
- Does only having API connection encrypted be enough?
Yes, this is a cost-saving measure, since this is for my hobby project and I would like to keep running costs as minimal as possible. But since I still exchange data, that should not be seen by 3rd party, this application needs to be secure.
To enable HTTPS I would need a second static IP, which is 3$ a month (which is not much), but again, it is additional cost for me, that I would rather not have.
My current architecture would look like this:
As can be seen from the image, I have 3 web applications - API, Public web (landing page) and "Portal" where I log in and can add and access data.
For the current use case, I am concerned about the left side of this diagram.
My question is regarding to
app.domain.com. Would it be safe to have it be on HTTP, when after downloading all communication with server would be over HTTPS (to API)? This app also includes login logic for user authentication.
As for my current web hosting I have those options for SSL. If I try to import new SSL, it requires me to have additional Static IP