What is SFTP? Why is it Used to Transfer Files?
As developers, we rarely get to experiment with different networking protocols. It’s pretty likely that the only protocol we have used so far is HTTP.
No shame in that 😆. Most of us are playing the limited role of REST API developers in our day jobs.
I have written a few articles on HTTP and HTTP3 previously, you might want to read that.
A similar application layer protocol is FTP.
By similar, this is what I meant: FTP and HTTP are application layer protocols and use TCP as the underlying transfer protocol.
HTTP is the backbone of the web and the internet. Most of the communication between the browser and server is done using HTTP.
FTP, on the other hand, is a file transfer protocol.
FTP protocol is used to transfer files between a client and a server.
FTP also has the mandate to validate the client's authenticity, which is not mandatory in HTTP.
So the question is, can we not use HTTP to transfer files and add an authentication process to make the transaction secure?
Well, it's possible, but FTP is considered a more efficient choice to share large files because -
FTP transmits raw data.
FTP doesn’t add headers and metadata to the transmitted data.
So with less overhead, we can share large files quickly.
You can still use the HTTP protocol to share files of smaller sizes.
We naturally arrive at the next question: By authenticating the client, can we ensure the transmitted data is secure?
Definitely NOT.
To ensure that data is shared securely between a client and a server, we need to add additional layers.
This task can be achieved in two ways —
We can add transport layer security (SSL/TLS) to FTP. This is known as FTPS. (Just like we add a security layer to HTTP and make it HTTPS)
Another way to securely transfer data is through Secure Shell (SSH) File Transfer Protocol (FTP). This is known as SFTP.
SFTP
SFTP is a security layer added to FTP by encrypting the transmitted data using Secure Shell.
Secure Shell or SSH is another network protocol that works in the client-server model.
SSH client drives the connection setup process and verifies the identity of the SSH server. Once the secure connection is established, protocols like FTP can be used to securely transfer data between the client and the server.
This ensures that the data transferred over the internet is secure.
Among cloud providers like AWS, Azure, and others, files from one storage service can be shared with another cloud provider’s storage service by setting up an SFTP client and SFTP server.
While in AWS, this can be achieved using AWS Transfer Family services, providers like GCP can use solutions available in the marketplace.
I hope this short explanation of SFTP helped you learn something new.