I am thinking how to implement the login of a new web application and as I search the net, most search result as about authentication instead of encryption.

Assumption: The web application is designed for corporate purpose. The web application are going to use REST api to communicate with backend.

The first two search result from a google search with "rest api spring https" are about authentication instead of encryption, although I have added keyword https. Isn't REST api based on HTTP, and HTTP is not encrypted?

We have some business data which are not very sensitive, such as account number. If I do not use encryption on the API return value, wouldn't all of it be plaintext and is available across the internet?


“IT Security” consists of very different goals. Encryption describes technologies that may be used to reach these goals, but is not a goal in itself.

One way to look at IT-Sec is the C–I–A triad: confidentiality, integrity, and availability of information. Confidentiality describes that the information is restricted to the intended recipients. For an API, this usually means that:

  • Users must authenticate themselves when contacting the API, i.e. demonstrate that they are a user who is authorized to access that information. Authentication schemes usually involve crypto (e.g. plaintext password over an encrypted connection, or an asymmetric authentication scheme).

  • The communication between user and API is confidential, i.e. encrypted. Using a HTTPS connection is an easy way to get that.

Transport encryption without authentication does not ensure confidentiality, because you might have an encrypted connection to an unauthorized user. And plaintext communication with an authorized user does not ensure confidentiality because the communication contents would be visible to other users on the same network and the network providers themselves. So you generally need both.

Not all data needs the same kind of protection. The sensitivity of data is not always obvious (e.g. see the German Tank Problem). However, using encryption with HTTPS has become so easy and cheap that there is no good reason to avoid transport encryption. HTTPS should therefore be treated as a minimum baseline for security.

  • Thank you. I am still confused because 90% of user authentication code tutorial does not cover the part of HTTPS. I know how to implement a web server for HTTPS, but I don't know how to implement HTTPS for normal HTTP API created by backend server – lamwaiman1988 Oct 10 '17 at 7:28
  • @lamwaiman1988 A HTTP API is a HTTP server. And to a developer, HTTPS is just HTTP over an encrypted connection. If you're using some kind of web framework it should have a configuration option to activate encryption with a certificate you provide. Otherwise, it's common to put a proxy between the user and your API. The proxy then handles HTTPS encryption. The API can often ignore this completely, and at most must update absolute links to point to the https:// version. – amon Oct 10 '17 at 10:02

Yes, they are equally important because both are vital to application security. Yet their implementation should be strictly separated.

Authentication and access control belongs to the application logic and could be implemented using Spring Security. However for a REST api it is quite common to use OAuth and a single-sign-on (SSO) server like Keycloak.

HTTPS or rather Transport layer security (TLS) is part of the communication protocol between server and client and should be handled by the application server, or better a reverse proxy server between client and application server. Nginx or Apache are often used for that purpose.

For proper HTTPS setup please keep in mind:

  • Obtain a TLS/SSL certificate from a commonly trusted issuer, e.g. https://letsencrypt.org/
  • The reverse proxy server should redirect all HTTP requests to HTTPS, and pass all HTTPS traffic to the application server
  • The application server should reject all HTTP traffic (can be configured in Spring Security)

Encryption is a useful tool for data security. However it's of little practical value if you the display your previously encrypted data to the wrong person.

That's why authentication is [more] important.

Any login system must use HTTPS.
If it doesn't, then the application's in for a nasty shock in the not-too distance future, if your users use Google Chrome. https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

If you have any "sensitive" data then, again, you should b using HTTPS to protect it "in transit" but it will wind up, in plain, on somebody's screen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.