Home/ Questions/Q 8826627
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-14T07:11:08+00:00

Are attacks like MITM possible when using HTTPS? I know they are possible if

  • 0

Are attacks like MITM possible when using HTTPS?

I know they are possible if the connection starts with HTTP then gets redirected to HTTPS, but what if the initial connection itself is using HTTPS?

I’m implementing a client which connects to a server using HTTPS and want to find out if my explicitly determining the authenticity of the server is necessary (not, not the server authenticating the client is who it says it is, but the client ensuring the server is who it says it is) – I’m doing this in iOS where an API is available which makes it easy to do, but I’m not sure if its necessary to do, and if I do, then how to test that it works.

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It’s absolutely possible to MITM SSL, and it’s often pretty easy if you don’t actually check the server’s certificate.

    Consider someone using your app in a coffee shop where a malicious employee has control over the wireless router. They can watch for HTTPS connections to your server and redirect them to a local MITM program. That program accepts the connection using a self-signed SSL certificate, say, and then opens a connection to your real server and proxies traffic between them.

    As long as you check the validity of the server’s certificate, this simple attack is thwarted. So do that. 🙂

    There are much more complicated attacks that have been demonstrated that can still, under special circumstances, MITM an SSL connection even when you check the certificates, but the circumstances that make those attacks work are difficult enough to arrange that most developers needn’t worry about them.

    • 0