asp.net-mvcc#-4.0http-postxml-encryption

Advantage of Encrypted XML message over HTTPS messages on C#

I am designing an XML over https message communication in my application.

My PM thinks doing x509.2 encryption to XML and transport message over https will be better secured.

I was wondering, as message is being transferred over HTTPS, it is already encrypted.

So will x509.2 encryption bring any additional security? or is it just an overhead?

These messages are simple HTTPWebRequest and HTTPWebResponse types

Additional security

  1. Client and Host are under firewall
  2. HTTPWebRequest carries Authorization tokens
Solution

  • It's just overhead. It's already secured using SSL. It's technically more secure to encrypt the XML as well but unless you are extremely concerned about the security of this data it's probably not worth the effort.