HTTPS Support | TVmaze

apxeno wrote 7 years ago: 1

Hello all!

First, I want to thank the community for their work in creating and maintaining this API. I have been experimenting with the API and am very excited to try it out in the near future.

However, there is one major problem with this API, it isn't secured.

Developers and major companies are pushing to adopt and use HTTPS for every web request.

Apple, for example, recently stated that "App Transport Security is becoming a requirement for App Store apps". Source: https://techcrunch.com/2016/06/14/apple-will-require-https-connections-for-ios-apps-by-the-end-of-2016/

I do not know if HTTPS is in the works but it would greatly benefit developers if this API was secured.

Thanks!

---------------

Signed, apxeno.

david wrote 7 years ago: 1

Thank you! :)

HTTPS is indeed planned, if all goes well somewhere this year.

gazza911 wrote 7 years ago: 1

@david - If you want a free SSL certificate (and automated installation), you can do that on Let's Encrypt

deleted wrote 7 years ago: 1

Am I correct in my understanding that the API will be unusable on iOS in 4 months?

gazza911 wrote 7 years ago: 1

Just to clarify: TVMaze itself does not maintain apps.

In short, the answer to your question is no...

In full, apps won't be able to make a direct connection to the API - the only logical reason I can think of doing this though is if the website that the app uses is currently down but you still want to be able to show updated information [in other words, you can't save the information to the website but you can still display it to the user]. If they still wanted this functionality, they'd have to do it through a HTTPS proxy (no longer a direct connection).

As long as the website that the app uses has HTTPS then you'll be fine as it's the website's server, not the app that is using HTTP connections.

ericgranger wrote 7 years ago: 1

Hi,

Is HTTPS will be supported before the end of year or we have to find another solution ? Apple communicated they will not accept in the app store the apps that do not connect in HTTPS for info. So it is mandatory for iOS app ...

Best regards

Eric

gazza911 wrote 7 years ago: 1

ericgranger wrote:
Hi,
Is HTTPS will be supported before the end of year or we have to find another solution ? Apple communicated they will not accept in the app store the apps that do not connect in HTTPS for info. So it is mandatory for iOS app ...
Best regards
Eric

As long as the server that the app connects is HTTPS then it doesn't matter if TVMaze supports it; it's your server, not the phone that connects to tvmaze - the phone connects to your server.

If your server doesn't have HTTPS - or for whatever reason you're connecting directly to TVMaze, then you can just use a HTTPS proxy instead.

P.S tvmazecdn.com - which is used for resources/images does have HTTPS

david wrote 7 years ago: 1

There are probably quite some apps connecting to our API directly :)

HTTPS is still planned for the near future. Likely this year, but I can't make any promises.

If you need it today, you could always set up your own nginx with SSL that proxy_pass'es everything to api.tvmaze.com.

david wrote 7 years ago: 1

See http://www.tvmaze.com/blogs/20/https-now-enabled-on-the-api!