Outgoing HTTP security

[Anonymous]

Good evening all,

Does anyone know (or better know where I would find documentation) on the security of API calls to servers outside the MSFT ecosystem?

My scenario:

I access an API endpoint across the open internet with a HTTP action in Power Automate. This endpoint takes basic authentication (Username & Password). The endpoint has no alternatives for authentication at this time.

Our security team are saying this is an unacceptable security risk.

My question is:

• Is the connector actually HTTPS (TLS or SSL)?
• How can I confirm this?

All of the info I can find is around securing flows against incoming HHTP requests for webhooks and the like, or for hiding the content of actions in run history.

Thanks!

[SudeepGhatakNZ]

HI @Anonymous ,

The connector provides you with several Authentication options. You can click on Advanced Options to see them.

To make the connection secure, you can use the “HTTP” action with Client Certificate authentication. Within the Pfx field of “HTTP” action, you should type the Base64-encoded contents representation of your PFX file. Within the Password field, type the password to access the PFX file.

[Anonymous]

Thankyou @SudeepGhatakNZ, I dont think this resolves my issue, but I am well aware of my lack of knowledge in this area. Please correct me if I am wrong.

The authentication method to the API I am trying to reach is 'Basic' only. This mean I must pass a Username and password. I do not have any pathway to look at the API beyond interacting with the endpoints.

As the endpoint is HTTPS://, this would require that the client initiate a session, complete a public key handshake process and then use this to pass the credentials and all other communications. 

I have sniffed packets and even changing the URL to HTTP:// results in the credentials being sent in plain text, but the response is a redirect to the HTTPS:// URL and the resulting TLS handshake.

The PFx file you suggested would require that the server has the capacity to handle session initialization using passed in public/private keys. Unless I am missing something??

[SudeepGhatakNZ]

@Expiscornovus , @Pstork1 , @Nived_Nambiar , have you had much experience working with external APIs?

Maybe you could guide @Anonymous here.