Sharing encrypted data between JavaScript and WebServer

Question

I have a Rails WebServer based on REST API
I have a AngularJS app, which connects to this WebServer

What is the best way to encrypt login and password on client side and decrypt these credentials on server side?

You can't do this in javascript because everything the javascript code is doing can be easily detected over the wire. If you want to send encrypted credentials you should use HTTPS. — Geoff Genz
– Geoff Genz, Commented Feb 17, 2014 at 18:47
Yes, I know. On the very end we'd like to use TSL to secure our connection, but for now, we have to rely on standard HTTP so we want to encrypt our data in JS and decrypt it on server. I use RSA for that now, but it's not the best way to do that. — Kamil Lelonek
– Kamil Lelonek, Commented Feb 17, 2014 at 18:52

Geoff Genz · Accepted Answer · 2014-02-17 21:20:39Z

1

If you are using RSA you have to have keys in the browser. The keys can't get to the browser unless they go over the unsecured HTTP connection. If an attacker has the keys by sniffing the HTTP connection, and the algorithm from your javascript code, you aren't protecting anything since decrypting your traffic becomes trivial.

I suggest putting an nginx proxy in front of your web server. You can configure nginx to do the TLS handshake, and you can get a Comodo SSL certificate for less than $15 a year. I've done this myself in front of a Python server and truly, that's all it cost.

answered Feb 17, 2014 at 21:20

Geoff Genz

2,17919 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Kamil Lelonek · Accepted Answer · 2014-02-17 22:00:35Z

1

I've just decided to use http://travistidwell.com/jsencrypt/index.html in way when I store public server key on client side and private server key on server side.

JS client encrypts all messages that are send to server.

answered Feb 17, 2014 at 22:00

Kamil Lelonek

14.9k14 gold badges70 silver badges94 bronze badges

Comments

DiegoSalazar · Accepted Answer · 2014-02-17 18:57:55Z

0

The best way, as mentioned by Geoff Genz, is to secure your web server with HTTPS and ensuring that your login action only accepts requests through HTTPS. Configure your angular app to make requests to the HTTPS URL of your login action and all encryption will be taken care of seamlessly. You won't have to worry about manually encrypting the data clientside and then decrypting serverside. All of this will be handled by the TLS protocol which make HTTPS work.

answered Feb 17, 2014 at 18:57

DiegoSalazar

13.5k2 gold badges42 silver badges58 bronze badges

1 Comment

Kamil Lelonek Over a year ago

But for now our server doesn't allow for TLS, and only when we got funds we can run on secure server. For now we have to find some encryption way.

Collectives™ on Stack Overflow

Sharing encrypted data between JavaScript and WebServer

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related