Hacker News Reader

Comment by tony-allan | Hacker News Reader

MITM is aways wrong and dangerous!

I would create a separate protected API that has an additional header such as:

  Forward-To-API: database-prod

And have that service lookup the URL and credentials in a secure database and create it's own request to the external service. Even better it could also be your audit log.

The Forward-To-API header would be stripped and the rest of the query would be passed through.

-- This is so obvious that it must already exist!

View on HN

I did start out this way, but I was trying to make something that would achieve the goal without requiring any changes to my application code. Setting the HTTPS_PROXY environment variable on the app server and adding the internal CA cert to the set of trusted authorities s is all that's required to get it working now, which is nice.

The thing you've described is still a MitM (the "protected API" can still see all of the request contents on their way to the destination).

Hard coding credentials is wrong but here is an example:

http://shairosenfeld.blogspot.com/2011/03/authorization-head...

You’ve just described an HTTP-based MITM.

Reply on news.ycombinator.com