An on-path attack, also called a man-in-the-middle attack, is one in which an attacker secretly positions themselves between a user and a service so they can read or alter the traffic passing between them. This can happen on a compromised network, such as an untrusted public Wi-Fi hotspot, through a malicious device or through a compromised router or proxy.
Without protection, the attacker could capture credentials, session tokens or other sensitive data, or change what the user sees. Encryption is the main defense. When a connection uses TLS and the client checks the server's certificate properly, an on-path attacker cannot read or change the contents without triggering a warning or a failure.
An on-path attack requires the attacker to be in the traffic path, so it is not the same as breaching the service itself. It also depends on a weakness in the connection, such as unencrypted traffic, a user clicking through a certificate warning, or software that skips certificate checks. Where encryption and verification work, the attack is much harder.
To reduce risk, use HTTPS everywhere, do not ignore certificate warnings, avoid sensitive actions on untrusted networks or use a trusted VPN, and keep devices and browsers updated. Developers should never disable certificate verification in production code.