3 ms·
MITM is aways wrong and dangerous! I would create a separate protected API that has an additional header such as: Forward-To-API: database-prod And have th
by tony-allan 4y ago
MITM is aways wrong and dangerous!
I would create a separate protected API that has an additional header such as:
Forward-To-API: database-prod
And have that service lookup the URL and credentials in a secure database and create it's own request to the external service. Even better it could also be your audit log.
The Forward-To-API header would be stripped and the rest of the query would be passed through.
-- This is so obvious that it must already exist!
- tony-allan 4y agoHard coding credentials is wrong but here is an example: http://shairosenfeld.blogspot.com/2011/03/authorization-header-in-nginx-for.html http://shairosenfeld.blogspot.com/2011/03/authorization-head...
- akerl_ 4y agoYou’ve just described an HTTP-based MITM.
- stanleydrew 4y agoI did start out this way, but I was trying to make something that would achieve the goal without requiring any changes to my application code. Setting the HTTPS_PROXY environment variable on the app server and adding the internal CA cert to the set of trusted authorities s is all that's required to get it working now, which is nice. The thing you've described is still a MitM (the "protected API" can still see all of the request contents on their way to the destination).