0

In Azure, if you choose to use internal endpoint (instead of input endpoint), https is not an option. http & tcp are the only options. Does it mean internal endpoint is 100% secure and you don't need encryption.

Then it comes to another question. If i choose to use input endpoint between mvc application and wcf service. Is it really necessary to have https between them? Is it OK if i have 2 input endpoints for wcf. One with http on port 80, which is supposed to be used by mvc application. Another with https on port 443, which can be used by somebody else. (not our own application)

zhenbzha
  • 5
  • 1
  • In addition to the answers below, Brent's answer to my question here may be of use to you: http://stackoverflow.com/questions/11584163/how-secure-are-windows-azure-internal-endpoints – Jude Fisher Oct 12 '12 at 09:21

1 Answers1

2

Do you need to encrypt internal endpoints?

No, a web/worker role cannot connect to an internal endpoint in another deployment. The Azure network prevents this, so man-in-the-middle attacks shouldn't be possible. Therefore, it's not necessary to enable SSL on internal endpoints.

Is is necessary to enable HTTPS on WCF endpoints?

It's certainly possible to configure your application in that way. Why not make the port 80 endpoint on the WCF service an internal one? Or - why not host the WCF application on the same Role, then you can just use the loopback address?

You need to think about the security requirements of your application and go from there.

Richard Astbury
  • 2,323
  • 18
  • 28
  • Thanks for answer. why not host the WCF application on the same Role - because I want to have independent scaling possibility. That can be achieved only with different web roles I have mvc web app on web role with https on port 443 and wcf service on another web role. For wcf service I have port 80 for internal endpoint, and port 449 for https for external use. Everything is fine. Until customer said from their office traffic with port other than 443 is blocked. So then I consider move wcf to different host service with port 443. – zhenbzha Oct 10 '12 at 14:22
  • But for communication between mvc and wcf, i don't want to have https. I only want to have https for wcf for external usage. So that raises the question, does http between mvc app and wcf really degrade security? – zhenbzha Oct 10 '12 at 14:23
  • So you're saying that you want to configure your application to use SSL on your external endpoint - that's fine, and no SSL on your internal endpoint, that's fine too (as you can't pose a man-in-the-middle attack on Azure). Or have I misunderstood something? – Richard Astbury Oct 10 '12 at 14:41
  • As said, originally, deploy web app & service on same host service. For WCF, I have internal endpoint (port 80) and external endpoint(port 449), mvc web app on port 443. However, 449 is not accessible for customer, they can only use 443. 443 is already used by web app. So only option is to have WCF deployed on another host service. Question is if MVC & MVC are in separate host service. Do I need to have https for their internal communication – zhenbzha Oct 10 '12 at 16:53
  • Ah, I get it now. The question is 'Is there a security risk connecting to web services on a different hosted service, using the public address'. The answer is 'yes', there is a small risk of a DNS spoofing attack. Probably not worth worrying about. – Richard Astbury Oct 11 '12 at 08:26