-2

For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific):

  • Do I need to enable SSL (HTTPS) for this application or web server that hosts this application as well, or is it not needed in the end?
  • Does only having API connection encrypted be enough?

Yes, this is a cost-saving measure, since this is for my hobby project and I would like to keep running costs as minimal as possible. But since I still exchange data, that should not be seen by 3rd party, this application needs to be secure.

To enable HTTPS I would need a second static IP, which is 3$ a month (which is not much), but again, it is additional cost for me, that I would rather not have.

My current architecture would look like this:

System architecture

As can be seen from the image, I have 3 web applications - API, Public web (landing page) and "Portal" where I log in and can add and access data.

For the current use case, I am concerned about the left side of this diagram.

My question is regarding to app.domain.com. Would it be safe to have it be on HTTP, when after downloading all communication with server would be over HTTPS (to API)? This app also includes login logic for user authentication.

As for my current web hosting I have those options for SSL. If I try to import new SSL, it requires me to have additional Static IP

enter image description here

enter image description here

6
  • 2
    The danger is that someone is in the middle of your enduser and app.domain.com and replaces your binary with a malicious one of their own. Same with your landing page. Are these risks high enough to require protection? We can't answer that for you, only you can.
    – schroeder
    Jul 2, 2020 at 10:03
  • Thank you for that input, although this application is meant for basically only for ~10 people to use for hobby we are doing, it still has some personal information (incl. phone, email). I'd still rather not take any chances.
    – Taurib
    Jul 2, 2020 at 10:09
  • So, the network between app.domain.com and your endpoints is the internet? And you are transferring personal information over that link? And you want to protect that info? And your question is whether you need TLS? I think you already have your answer...
    – schroeder
    Jul 2, 2020 at 10:50
  • Personal info would be transferred between app.domain.com and api.domain.com. But yes, from your previous comment I'd say, I would still need to secure my app.domain.com as well.
    – Taurib
    Jul 2, 2020 at 11:58
  • 1
    For free ssl letsencrypt.org. This should help you in cost cutting without security compromised.
    – Aravind
    Jul 2, 2020 at 18:02

2 Answers 2

3

To enable HTTPS I would need second Static IP, which is 3$ a month (which is not much), but again, it is additional cost for me, that I would rather not have.

You don't need a second static IP. Server Name Indication (SNI) has been a thing for quite some years now, and all modern clients supports it, including all major browsers.

2
  • I think I need to check it up with my hosting provider then. Since I "straight forward" way seems to have complications for that.
    – Taurib
    Jul 2, 2020 at 10:10
  • You don't even need SNI, if you already have a wildcard certificate *.example.com covering both app.example.com and api.example.com. Jul 2, 2020 at 17:30
1

When in doubt, encrypt everything.

Now, ask yourself what are you protecting and what from. Since it is a hobby, well...

If you use the app.domain.com just for downloading the app, that may render a smaller attack surface, but still there is a risk. I agree with @schroeder in the risk of having a binary replaced with malware.

For some time now, Google Chrome browser has been marking every HTTP page as not secure so, this may be a problem for some users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.