I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on external server, do something, when done do a call back to rest api on Kinvey.

I'm not using any sort of secure layer like SSL, and I don't plan to use it in the near future because I have no idea what kind of certificate I have to buy

What authentication should I implement so communication between the two are safe? As far as I know I could have the same key on each server and encrypt the data, as only both servers know it, then it is secure? if so, which encryption should I use and why?

Also I read that Kinvey uses basic auth, which sends the password in plain text? This is not secure at all, so is it better to use their session authentication? Or just buy an ssl certificate (what kind?)

  • Use SSL. There are free certificates available, or if you don't use a browser as client you can even hardcode the expected certificate in the client or add a custom CA. – CodesInChaos Nov 5 '13 at 21:04
  • Thanks for the comment. Can you recommend some places where i can get those free (and decent) certificates? – Captain Obvious Nov 5 '13 at 22:28
  • @CaptainObvious www.letsencrypt.com for further reference – EralpB Mar 6 '17 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.