How to secure Mule applications traffic

Question

A client of mine has a bunch of APIs in CloudHub that communicate with two APIs on premise in their runtime. The question I get asked, to which I don't really know the answer, is how to secure the communication between the APIs on CloudHub and on premise without using API Manager (since the client preferred not to pay for it) ? I thought of a middleware (middleware inception) that hashes the messages from one end to another, is this a viable idea? What could the best answer be?

Answer 1

The server applications should implement some basic security best practices like authentication and encryption.

Having applications deployed in any cloud environment without security is a big security risk. I assume that there is a secure link between the CloudHub environment and their on premise environment, like a VPN, but even so this architecture would not probably pass a security audit.

They should implement authentication using HTTP Basic authentication or OAuth 2. These are the most common authentication schemas used for REST APIs. Note that credentials go in clear text so they should also implement encryption.

To encrypt the traffic the server applications should use TLS, ie HTTPS connections instead of plain HTTP.

Optionally you could also implement mutual TLS authentication, requiring the client to have a valid certificate that the HTTPS server validates.

Hashing message could be an additional level of security, but that implies changing the applications logic to implement some custom security. The effort should be better put into implementing standard security practices as mentioned. If after that you want to add it feel free to do so.

You have not shared details of the technology of the on prem applications. Mule applications can implement both the client and server side of any of these methods. Read the documentation for details:

• https://docs.mulesoft.com/http-connector/1.7/http-authentication
• https://docs.mulesoft.com/mule-runtime/4.4/tls-configuration
• https://help.mulesoft.com/s/article/Tutorial-how-to-create-a-simple-Mule-4-http-basic-authentication-application