Is endpoint with HTTPS not enough to avoid sniffing attacks?
My Endpoint is accompanied by HTTPS but if I post user credentials via this endpoint, how is it vulnerable to sniffing attacks? Is endpoint with HTTPS not enough or some other implementations are also required?
If I POST user credential via an REST endpoint.
Statement 1: My endpoint is HTTPS enabled.
Statement 2: The transmission channel is HTTPS encrypted.
What are the differences in these 2 statements?
I am sending post request via https enabled REST api even though the post data is visible when intercept is on.
Following image was provided by our VAPT team saying that the endpoint is not secure since they are able to intercept the traffic and retrieve the post data like username and password.
HTTPS encrypts the transmission channel so that any node between the client and server cannot read the plaintext content. The traffic can still be sniffed, but the sniffed data is encrypted. This is a very important distinction because if the encryption is weak or if it is cracked in the future, any saved, encrypted data might be decrypted.
What is the difference between:
- My endpoint is HTTPS enabled.
- The transmission channel is HTTPS encrypted.
It's the difference between "I know how to bake a cake" and "I am baking a cake". Just having something enabled doesn't mean it is being used or that HTTPS hasn't been bypassed or disabled somehow.
- Swift (Xcode) REST API Connection using OAuth 1
- REST API Authentication
- FastAPI conflict path parameter in endpoint - good practices?
- Netsuite REST API for cross-subsidiary item fulfillment
- Spring Boot 3: Exclude REST Endpoints from Authorization
- How to make a large file accessible to external APIs?
- Disable default routes of WP REST API
- How to set the Content-Type header for an HttpClient request?
- "Content type 'application/json;charset=UTF-8' not supported" in Spring Rest application
- ConnectWise API getting Invalid Token response
- 403 Forbidden when introducing authorization on spring boot rest
- Using EU VIES REST Service to check VAT Number
- How do I handle plain text HTTP Get response in Golang?
- Jax-rs apache-cxf:No resource methods have been found for resource class
- How get a list with all items beginning with request param from optional stream
- Is it okay to use an HTTP DELETE to deactivate a record?
- how to update dynamodb with pynamodb ORM?
- How to optimize performance and reduce load while designing a RESTful API for displaying related and sibling objects?
- Java Spring: Unsupported Media Type with x-www-form-urlencoded body
- When to use HTTP status code 425 "Too Early"
- How to upload files and attachments to the sobject record using REST API?
- Service Oriented Architecture suggestions
- How to post JSON data to FastAPI and retrieve the JSON data inside the endpoint?
- Polar Accesslink API 403
- How to add multiple headers to RestClient for Spring Boot 3.2
- Could not read JSON: Unrecognized field (...), not marked as ignorable
- How to Get All Endpoints List After Startup, Spring Boot
- Conflicting REST urls
- Powershell Invoke-RestMethod
- REST API (Lambda integration) deployment using Terraform - POST is giving 200, but GET is giving 500