Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game).

Users can download new questions from a server's API. Next, the users can upload new questions they made up to contribute to a common database of questions.

I was pretty much always taught to use a HTTPS on production servers. However: do I really need to use HTTPS with some kind of security token in this case? Is there a way to inject some malicious questions if simple HTTP is used? Or other threats?

2 Answers 2


Do you care if a 3rd party monitors or modifies a request in transit from the client to you or from you to the client?

If you don't care, just use HTTP. If you do care, use HTTPS.

Is there a way to inject some malicious questions if simple HTTP is used? Absolutely, the real question is does it justify the extra cost of developing a HTTPS system to prevent that from happening? (most of the time the extra cost to implement HTTPS over HTTP is so minimal the answer to the question usually is "yes, the cost is justified")

  • Got it. By the way the attacker could inject the malicous questions only to specific devices right? For example on local network. However he couldn't replace all the questions I send from our API. He could of course submit a lot of fake questions to my server, but I could handle that before sending (suppose there would be some kind of "approve" proccess).
    – tsusanka
    Commented Dec 6, 2013 at 10:22
  • Yes, essentially the attacker would be in a privileged network position (e.g. on the same local subnet as the user) and would either sniff the traffic, or perform some kind of spoofing (e.g. ARP / DNS spoofing) to intercept and modify traffic. I still generally recommend HTTPS anyway, because the overhead and cost is minimal - there's not much of a reason not to use HTTPS! But it's not critical in this case.
    – Polynomial
    Commented Dec 6, 2013 at 10:35

Do you use any authentication for your API? If you do, then you should consider leakage of users credentials.

OAuth 1.0a lets you stay safe from this, as private key is never transmitted, but is used to create cryptographic signature instead. With OAuth2 or "classic" authentication schemes your users credentials are transmitted in clear-text and you have to protect them with HTTPS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .