Transport Layer Security (TLS) protects web traffic by encrypting communication between a browser and an application. HTTPS uses an SSL/TLS certificate so attackers cannot read or modify requests and responses. section 28.1
Unencrypted HTTP exposes passwords, personally identifiable information, authentication cookies, and response content to attackers on the same network. Attackers may also modify traffic or inject malicious code. section 28.1
Applications can use TLS in several deployment arrangements:
- Terminate TLS directly in the application, keeping traffic encrypted to the application. section 28.1
- Use a reverse proxy with TLS passthrough, keeping traffic encrypted to the ASP.NET Core application. section 28.1
- Use a reverse proxy with TLS offloading, letting the proxy decrypt traffic before forwarding it to the application. section 28.1
- Enforce HTTPS across the application, reject insecure requests where appropriate, and use HSTS to encourage browsers to remain on HTTPS. section 28.4
Choosing HTTPS enforcement
A web API may reject insecure HTTP requests entirely. An application behind a reverse proxy may rely on that proxy for TLS handling, while HSTS helps browsers prefer HTTPS. section 28.4
Figure 28.1 Unencrypted HTTP requests can be read by users on the same network. Attackers can even intercept the request and response, reading or changing the data. HTTPS requests can’t be read or manipulated by attackers.
Compare the exposure of unencrypted HTTP with the confidentiality and integrity provided by HTTPS. section 28.1
