The stateless nature of REST requires that a Secure Gateway assume that all client-side traffic is suspect and all back-end messages are authorized and valid.

If your system USES SSL to secure communications, then you can capture the network traffic, but it is all encrypted, preventing you, the developer, from gaining any useful information.

When configuring a secure environment, you must make sure that every component provides for appropriate authentication, authorization, and encryption of network traffic.