3 ms·
I'm not sure what you mean by implementation of TLS. It's just standard Java TLS libraries, though of course we can be pretty strict about which ciphers are in
by hotpotamus 4y ago
I'm not sure what you mean by implementation of TLS. It's just standard Java TLS libraries, though of course we can be pretty strict about which ciphers are in use - we do control the client to that extent and are typically pretty good about keeping on top of that at least.
- robryk 4y agoIf you require client certificates then you don't need to worry about non-insider attacks on anything other than your TLS library and your client cert bootstrap procedure.
- hotpotamus 4y agoI didn't even think of that as a possibility, but it's a good suggestion and something that's within the realm of feasible (though far from trivial) for us. Thank you.
- robryk 4y agoTBF putting a reverse proxy that does authn and rejects requests that do not authn correctly in front of everything (except for the login pages) is nearly as good: the exposed area is then login page, reverse proxy, and the authn login in the reverse proxy. That might be vastly simpler to implement.