HTTPS for APIs
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
know what HTTPS protects.
Planned topics
- HTTPS is HTTP inside TLS, an encrypted channel.
- It protects against eavesdropping (passwords, tokens, data) and tampering on the network.
- It lets the client verify it talks to the real server, through a certificate.
- It does not stop bugs in your API or tell you who the user is.
- Production APIs must never run on plain HTTP; tokens and passwords would travel readable. Commonly TLS ends at a load balancer or reverse proxy.
Draft outline details
Demonstration
a sketch of a request through a public Wi-Fi: plain HTTP shows the token to everyone; HTTPS shows scrambled bytes.
Check your understanding
Does HTTPS make an API free of vulnerabilities?
Show answer
No; it only protects the connection.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.