Vapor: Load Balancer Security Policy Updates

Nuno Maduro
Nuno Maduro
Share:
  • ...
  • ...
  • ...
...

By default, Vapor routes HTTP traffic to your serverless applications using AWS API Gateway. As an alternative to API Gateway, some customers have chosen to route their application traffic using Load Balancers, which can provide large cost savings at scale.

AWS load balancers use "security policies" to determine which versions of the TLS protocol are supported. The default AWS load balancer security policy (ELBSecurityPolicy-2016-08) supports TLS 1.0, TLS 1.1, and TLS 1.2.

However, versions of TLS prior to TLS 1.2 have known security vulnerabilities. Therefore, beginning today, all new load balancers will use a security policy that no longer supports TLS 1.0 and TLS 1.1 (ELBSecurityPolicy-TLS-1-2-Ext-2018-06). All modern browsers, including IE 11, and 98.5% of all Internet devices support TLS 1.2.

image

For existing load balancers, it is highly recommended that you modify them to use TLS 1.2 only. To do so, you can manually update the security policy by clicking on the "Edit" load balancer button in the network details of the Vapor UI. This update will not cause downtime for your application.

image

At Laravel, we're committed to providing you with the most robust and developer friendly PHP experience in the world. If you haven't checked out Vapor, now is a great time to start! You can create your account today at: vapor.laravel.com.

Latest Stories

Here’s what we've been up to recently.

Request a code sample

Certified Quality. Great Prices

We use cookies to improve your experience and to help us understand how you use our site. By using this site, you accept our use of cookies. Cookie Infox