SignalR - Security - Encryption?

Question

Hello there!
So currently I am working on a Blazor-Serverside-project. Since I needed to transfer sensitive data from the Server to the client and back, I asked myself how secure SignalR is handling such data. Turns out, not that well. Actually, I was able to read out the data directly in Chrome (Network tool) - so no encryption or something else.
Now I was wondering if there is a very simple trick to maybe enable such security features. Since Balzor does all the job around SignalR, I am a total noob in terms of SignalR.
Yes, I know there is something called SSL, but that is currently no option for me.
Does anyone have an Idea?
Thanks in advance!

Answer 1

Your site needs to be SSL (https), for the Signal/r traffic to be encrypted.

with SSL, the browser does the encryption/decryption, so the network tools see the unencrypted data.

as always you should never send hidden html data to the client, if you do not want them to have access.

note: you use SSL so network sniffers (public wifi, etc), can not intercept the client data. It does not protect your data from the client. your code must do that. if you pass PMI data (personal data) without SSL, you may be legally liable for a data breach from a sniffer.

Answer 2

Yes, I know there is something called SSL, but that is currently no option for me.

Perhaps you don´t know or even search for, but since free LetsEncrypt certificate there is no need to buy a certificate, give a try docs