title: Is HTTPS protocol relevant for REST API Webservices?
body: <p>I have a HTTP REST API in PHP used by an iPhone application.</p>
  
  <p>Some webservices from this API are secured with a user authentication in the HTTP request credentials but I want to avoid "man in the middle" attacks by providing fully encrypted requests data.</p>
  
  <p>I'm not really skilled in security issues and I couldn't find any clear answer to my question anywhere :</p>
  
  <p>Is HTTPS relevant for STATELESS REST API ?</p>
  
  <p>From what I understood, HTTPS does 2 things :</p>
  
  <ul>
  <li>encrypt your session</li>
  <li>prove to the client that the server he is talking to is secured</li>
  </ul>
  
  <p>So at first sight it does not respond to my need which is to encrypt the data between my server and the application because the API does not use sessions. But I still have doubts.</p>
  
  <p>Can someone make it clear to me ?</p>
  
  <p>My other solution would by to encrypt requests data with public/private keys system. Would it be more suitable ?</p>
  
  <p>Thank you !</p>