TLS protects one hop, not the journey
TLS does three things, and only three, between the two endpoints of one connection:
- Confidentiality — somebody in the middle cannot read the content.
- Integrity — somebody in the middle cannot alter it undetected.
- Server authentication — the client knows it is talking to the host named in the certificate.
Those three are enough for the threat "somebody on the same Wi-Fi". They do not address three families of problem people commonly assume they do:
(1) TLS does not protect data at either end. It protects the wire. Data leaves TLS at the load balancer and enters its logs; leaves at the API gateway and enters a trace; reaches the browser and enters localStorage. Every TLS termination point is a place the data is plaintext.
(2) TLS does not hide the URL from every eye. The body is encrypted, but the URL enters server access logs, proxy logs, the Referer when a user clicks onward, browser history, and Sentry reports. This is why a token in a query string is a bug even over HTTPS — and why the Implicit flow in oauth-flow-choice was deprecated.
(3) TLS does not authenticate the client, unless you configure mTLS. A certificate proves who the server is. It says nothing about the client.
And three things worth configuring beyond "TLS is on":
| Setting | Stops | The trap |
|---|---|---|
HSTS with includeSubDomains | The first HTTP connection being intercepted and downgraded | A long max-age while experimenting cannot be undone |
| TLS 1.2 minimum, prefer 1.3 | Old protocols and cipher suites with known holes | Old clients lose connectivity; measure first |
| Certificate validation on outbound calls | MITM on your own calls to third parties | Very often disabled "to make dev work" |
That third row deserves emphasis: ServerCertificateCustomValidationCallback = (_,_,_,_) => true is one line that disables server authentication entirely for every outbound call. It gets added to make a self-signed dev certificate work, and it usually stays.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…