0

I'm a self taught back end engineer so I'm learning all of this stuff as I go along. For the longest time, I've been using basic authentication for my users.

Many developers are advising against this approach since each request will contain the username & password in clear text. Anyone with the right skills can sniff on the connection between my iOS application and my Django/Gunicorn Server and obtain their password.

I wouldn't want to put my user's credentials at risk so I would like to implement a more secure way of authentication.

SSL seems to be the most viable option. My server doesn't serve any static content or anything crazy of that sort. All the server does is send and receive "json" responses from and to my iOS application. Here is my current topology.

iOS application ------> Amazon Elastic Load Balancer -------> EC2 Instances running HTTP Gunicorn.

Gunicorn runs on port 8000. I have a CNAME record from GoDaddy for the Amazon Elastic Load Balancer DNS.

So instead of using the long DNS to make requests, I just use server.example.com.

To interact with my servers I send and receive requests to server.example.com:8000/

This setup works and has been solid. However I need to have a more secure way. I would like to setup SSL between my iOS application and my Elastic Load Balancer. How can I go about doing this?

Since I am only sending json responses to my application, do I really need to buy a certificate from a CA or can I create my own? (since browsers will not be interacting with my servers. My servers are only designed to send json responses to my iOS application).

deadlock
  • 185
  • 2
  • 8

1 Answers1

0

Your ELB can listen on any port you specify and target any port in your server. For backwards compatibility, I'd suggest using another port (e.g. 8001) as your secure port and communicate through a secure connection in a new version of your application. You add a listener to your load balancer, upload the certificate for server.example.com (through the web interface) and voila, you can now use a secure connection between your users and your ELB. You can even use the same port to query your backend server from the ELB.

As a developer, I would also like to suggest increasing security even further by, for example, using session based authentication instead of resending a users username and password with every request.

Jaap Haagmans
  • 414
  • 1
  • 3
  • 11