Home/ Questions/Q 7850917
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-02T19:01:08+00:00

I have a HTTP REST API in PHP used by an iPhone application. Some

  • 0

I have a HTTP REST API in PHP used by an iPhone application.

Some webservices from this API are secured with a user authentication in the HTTP request credentials but I want to avoid “man in the middle” attacks by providing fully encrypted requests data.

I’m not really skilled in security issues and I couldn’t find any clear answer to my question anywhere :

Is HTTPS relevant for STATELESS REST API ?

From what I understood, HTTPS does 2 things :

  • encrypt your session
  • prove to the client that the server he is talking to is secured

So at first sight it does not respond to my need which is to encrypt the data between my server and the application because the API does not use sessions. But I still have doubts.

Can someone make it clear to me ?

My other solution would by to encrypt requests data with public/private keys system. Would it be more suitable ?

Thank you !

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, it is. HTTPS has nothing to do with the application, it’s a tunneling protocol. Even though TLS is itself a stateful protocol, the HTTP part going over it is not.

    Just like if you were using a VPN, you can still have a REST based application. The TLS just sets up and tears down the tunnel automatically for each connection.

    That said, there’s value in leveraging the pipelining aspects of HTTP and HTTPS to improve throughput over TLS connections, but that’s a performance tuning aspect unrelated to the application itself.

    • 0