Supporting HTTPS requests

Most web applications use HTTPS, where HTTP requests are sent over an encrypted network connection using the TLS/SSL protocol. Using HTTPS ensures that the request and response cannot be inspected as they traverse public networks.

Supporting SSL requires a certificate that establishes the identity of the server and is used as the basis for the encryption that secures HTTPS requests. For this chapter, I am going to use a self-signed certificate, which is sufficient for development and testing, but should not be used for deployment.

Note

See https://letsencrypt.org if you want a certificate for deployment. The Let’s Encrypt service is supported by a non-profit organization and offers free certificates suitable for use with HTTPS.

Creating the self-signed certificate

The easiest way to create a self-signed certificate is to use the OpenSSL package, which is an open-source toolkit for security-related tasks. The OpenSSL...