Use HTTPS backend connections

Security · API Management · Rule · 2020_06

Use HTTPS for communication to backend services.

Description

When API Management connects to the backend API it can use HTTP or HTTPS. When using HTTP, sensitive information may be exposed to an untrusted party.

Additionally, when configuring backends:

• Use a newer version of TLS such as TLS 1.2.
• Use client certificate authentication from API Management to authenticate to the backend.

Recommendation

Consider configuring only backend services configured with HTTPS-based URLs.

Examples

Configure with Azure template

To deploy APIs that pass this rule:

• Set the properties.serviceUrl property to a URL that starts with https://.

For example:

Azure Template snippet

{
    "type": "Microsoft.ApiManagement/service/apis",
    "apiVersion": "2021-08-01",
    "name": "[format('{0}/{1}', parameters('name'), 'echo-v1')]",
    "properties": {
        "displayName": "Echo API",
        "description": "An echo API service.",
        "path": "echo",
        "serviceUrl": "https://echo.contoso.com",
        "protocols": [
            "https"
        ],
        "apiVersion": "v1",
        "apiVersionSetId": "[resourceId('Microsoft.ApiManagement/service/apiVersionSets', parameters('name'), 'echo')]",
        "subscriptionRequired": true
    },
    "dependsOn": [
        "[resourceId('Microsoft.ApiManagement/service', parameters('name'))]",
        "[resourceId('Microsoft.ApiManagement/service/apiVersionSets', parameters('name'), 'echo')]"
    ]
}

To deploy API backends that pass this rule:

• Set the properties.url property to a URL that starts with https://.

For example:

Azure Template snippet

{
    "type": "Microsoft.ApiManagement/service/backends",
    "apiVersion": "2021-08-01",
    "name": "[format('{0}/{1}', parameters('name'), 'echo')]",
    "properties": {
        "title": "echo",
        "description": "A backend service for the Each API.",
        "protocol": "http",
        "url": "https://echo.contoso.com"
    },
    "dependsOn": [
        "[resourceId('Microsoft.ApiManagement/service', parameters('name'))]"
    ]
}

Configure with Bicep

To deploy APIs that pass this rule:

• Set the properties.serviceUrl property to a URL that starts with https://.

For example:

Azure Bicep snippet

resource api 'Microsoft.ApiManagement/service/apis@2021-08-01' = {
  parent: service
  name: 'echo-v1'
  properties: {
    displayName: 'Echo API'
    description: 'An echo API service.'
    path: 'echo'
    serviceUrl: 'https://echo.contoso.com'
    protocols: [
      'https'
    ]
    apiVersion: 'v1'
    apiVersionSetId: version.id
    subscriptionRequired: true
  }
}

To deploy API backends that pass this rule:

• Set the properties.url property to a URL that starts with https://.

For example:

Azure Bicep snippet

resource backend 'Microsoft.ApiManagement/service/backends@2021-08-01' = {
  parent: service
  name: 'echo'
  properties: {
    title: 'echo'
    description: 'A backend service for the Each API.'
    protocol: 'http'
    url: 'https://echo.contoso.com'
  }
}

Links

• Data encryption in Azure
• Manage protocols and ciphers in Azure API Management
• Secure backend services using client certificate authentication in Azure API Management
• Azure deployment reference for APIs
• Azure deployment reference for backends

---

Last update: 2022-12-03

Comments