Module 76: API and Network Security
TLS everywhere
🏠The everyday picture
Sending valuables by registered, sealed courier for the whole journey, not just the first leg, then by open cart for the rest.
📘What it really is
- TLS (Modules 6 and 66) encrypts data in transit and proves the server's identity through certificates.
- Everywhere means:
- browser → Nginx: HTTPS with HSTS, HTTP redirected;
- app → database: over the network, require TLS (
sslmode=requireorverify-fullin PostgreSQL connection strings); managed databases support it; - app → other services: always
https://URLs; never turn off certificate checks (rejectUnauthorized: falsein Node.js is a serious mistake that's easy to leave in); -
inside one server (Nginx → API on 127.0.0.1) TLS is usually unnecessary, because traffic doesn't leave the machine.
-
Good TLS settings: TLS 1.2 and 1.3 only, modern ciphers (Mozilla's SSL Configuration Generator gives Nginx settings), automatic certificate renewal, and an alert before expiry (Module 72).
-
Certificate verification is what makes TLS meaningful: it proves you're talking to the real server, not an attacker in the middle.
-
mTLS (mutual TLS): both sides present certificates. Used between internal services or for high-security partner APIs.
🖱️Try it
Run the SSL Labs test on your HTTPS site and reach an A. Check your API's database connection string uses TLS when the
database isn't on the same machine. Search your code and configuration for rejectUnauthorized, NODE_TLS_REJECT_UNAUTHORIZED
and http:// URLs to outside services, and fix any you find.
✅Quick check
Why is turning off certificate verification dangerous?
Show the answer
It removes the proof of who you're talking to, so an attacker in the middle could read or change the traffic.
Does traffic between Nginx and an API on 127.0.0.1 need TLS?
Show the answer
Usually not, because it never leaves the server.