Search code examples
securityssltransmission

Can a client see the data before it's sent using SSL?

During the workflow of my application, there are some "reconfiguration" messages I'd like the user not to be able to see.

I'm going to use SSL for protecting those messages while they are in transit, but I'm not sure if the client can see them before they are encrypted.

Solution

  • Your application is running on a computer the user has full access to. Therefore the user can manipulate your application and application memory and extract everything "secret" you implement.

    The same is true for SSL connection. By simply adding a Man-in-the-Middle attack proxy into the network path the user will be able to see everything that is transmitted. Or the user can grab the data unencrypted from the application memory before you send them via SSL/TLS.

    Conclusion: Don't rely on data that needs to be kept secret on client side. If it is secret data only process it on server side.