FresherTechnicalAuthentication & security
What does TLS protect, and what does it not protect?
Try answering first
Model answer
TLS protects data in transit between a client and a server. It gives three guarantees: confidentiality (traffic is encrypted), integrity (tampering is detected) and server authentication (the certificate proves you reached the real domain).
During the handshake the client checks the server certificate against trusted certificate authorities, then both sides agree on session keys. TLS 1.3 needs one round trip for this and is the version you should prefer; TLS 1.0 and 1.1 are obsolete. With mutual TLS the client also presents a certificate.
TLS does not protect:
- Data at rest in the database or on disk.
- Your application logic. A SQL injection or broken access check works fine over HTTPS.
- The endpoints. Malware on the client, or a compromised server, sees plain data.
- Metadata such as the server name and traffic size, partly visible to observers.
Takeaway: TLS secures the pipe, not the application at either end.
Key points
- Three guarantees: confidentiality, integrity, server identity
- Certificates are validated against trusted CAs
- Prefer TLS 1.3, drop TLS 1.0 and 1.1
- It does not protect data at rest or application bugs
Likely follow-ups
- What is the difference between TLS and mutual TLS?
- What does HSTS add on top of HTTPS?
Common mistakes
- Believing HTTPS makes an application secure by itself
- Disabling certificate verification to silence errors in code