我正在为组织开发一个小型演示API。我使用Azure AD进行API（和OpenAPI文档）的身份验证。一切都在我当地的开发环境中完美效果，而且我没有SSL的麻烦，因为OAuth2重新定位是Localhost。现在，我准备在组织的网络中使我的演示加入。但是，Azure App注册要求OAuth2重新定位链接必须为HTTPS（或Localhost，这就是为什么它对我的工作非常有效的原因）。我能理解原因，但是我渴望演示我的API，因此，如果可能的话，我想避免设置反向曲线，配置TLS等的麻烦，所以我的问题是 - 如果我使用 https://10.xxxnip.io/oauth2-redirect 这是什么安全含义？我担心它们是不幸的。我想nip.io如果愿意的话可以嗅我的授权？
I am developing a small demo API for my organization. I use Azure AD for authentication for the API (and the OpenAPI docs). Everything works perfectly in my local development environment and I don't have the hassle of SSL since the oauth2-redirect is localhost. I am now ready to make my demo accesible inside my organization's network. However, Azure App Registration mandates that a oauth2-redirect link has to be https (or localhost which is why it works perfectly for me). I can understand why, but I am eager to demo my API and so, if at all possible, I would like to avoid the hassle of setting up a reverse-proxy, configuring TLS etc. So my question is - if I use https://10.x.x.x.nip.io/oauth2-redirect what are the security implications of this? I fear they are major unfortunately. I guess nip.io could sniff my authorization if they wanted to?
发布评论
评论（1）
这不是严格的答案，因为它没有讨论Nip.io的安全含义。但是，如果TLS是演示的问题，它将自动为Azure应用程序配置。因此，对于小型演示，将作为Azure App服务部署非常方便，尤其是如果您在私人链接后面保护它。
This is not strictly an answer, since it doesn't discuss the security implications of nip.io. However, if TLS is an issue for a demo it is automatically configured for an Azure App Service. For small demos it is therefore very convenient to deploy as an Azure App Service especially if you protect it behind a private link.