Skip to content

2.3-python-api-https.md

Latest commit

 

History

History
87 lines (64 loc) · 3.4 KB

2.3-python-api-https.md

File metadata and controls

87 lines (64 loc) · 3.4 KB
Raw

Lab: Securing Your API with HTTPS and SSL Certificates

What is HTTPS?

  • HTTPS (HyperText Transfer Protocol Secure) is the secure version of HTTP. It encrypts all data sent between the client (browser, script) and the server, protecting it from eavesdropping and tampering.
  • HTTPS uses SSL/TLS (Secure Sockets Layer / Transport Layer Security) to provide encryption, authentication, and data integrity.

How Does HTTPS Work?

  • Public Key Cryptography:
    • The server has a public key (shared with everyone) and a private key (kept secret).
    • When a client connects, the server sends its public key in a digital certificate.
    • The public key is used to securely establish a shared session key, which is then used to encrypt all communication.
  • Digital Signatures:
    • The server proves its identity by signing data with its private key.
    • The client verifies the signature using the public key.
  • Encryption:
    • All data sent between client and server is encrypted, so attackers cannot read or modify it.

Why Use HTTPS?

  • Prevents attackers from reading sensitive data (like passwords, tokens, cookies).
  • Protects against man-in-the-middle attacks.
  • Required for secure cookies (like HttpOnly and SameSite cookies).

Generating SSL Certificates with OpenSSL

To run your Flask app with HTTPS locally, you need a self-signed SSL certificate. You can generate one using openssl:

# Generate a private key
openssl genrsa -out key.pem 2048
# Generate a certificate signing request (CSR)
openssl req -new -key key.pem -out csr.pem
# Generate a self-signed certificate (valid for 365 days)
openssl x509 -req -days 365 -in csr.pem -signkey key.pem -out cert.pem
  • This will create key.pem (private key) and cert.pem (certificate) in your directory.
  • Note: Because this is a self-signed certificate, browsers will show a security warning. This is expected in local development.

Example: Flask App with HTTPS

from flask import Flask, request, jsonify, make_response
import ssl

app = Flask(__name__)

@app.route('/')
def index():
    resp = make_response({'message': 'Hello, HTTPS world!'})
    # Example: set a secure, HttpOnly cookie
    resp.set_cookie('jwt', 'demo-token', httponly=True, secure=True, samesite='Lax')
    return resp

if __name__ == '__main__':
    context = ('cert.pem', 'key.pem')  # Path to your cert and key
    app.run(ssl_context=context, debug=True)
  • The secure=True flag ensures the cookie is only sent over HTTPS.
  • Browsers will not send cookies with secure=True over plain HTTP.

Testing with curl

You can test your HTTPS Flask app with curl using the -k flag to ignore certificate trust errors (for local testing only):

curl -k https://localhost:5000/
  • -k tells curl to ignore certificate trust errors. This is safe for local development, but never use it in production.

Your Task

  1. Use openssl to generate a self-signed certificate and private key as shown above.
  2. Update your Flask app to use HTTPS by passing ssl_context to app.run().
  3. Make sure all cookies that store sensitive data (like JWTs) are set with both httponly=True and secure=True.
  4. Test your app by visiting https://localhost:5000/ and inspecting the cookies in your browser or with curl.

This lab will help you understand how HTTPS protects your API and how to secure authentication cookies in a real-world app!