I need to clarify something that some experts would probably know better about.
there is domain company.com, and there is a web server called server1.domain.com. This server is a dedicated web server, no other roles is installed.
IIS7 is installed on server1.domain.com, and it's opened to the web using http://domain.com/something (a reverse proxy entry).
there is a SSL certificate available when trying to access https://domain.com.
my question is: if i enable BASIC authentication on a web folder(lets call it app1) on the server(server1.domain.com), and access it through the reverse proxy:
(note the S in http) the traffic that come from the reverse proxy to server1.domain.com is NOT secure. Am I correct?
the traffic that originates from client to domain.com IS SECURE. Does this mean user name and password travel from domain.com to server1.domain.com in base 64 CLEAR text? My reasoning is:
by the time username and password gets to domain.com, they will be decrypted, but they still need to travel to server1.domain.com. am i correct?
If so, how do i ensure secured traffic from domain.com to server1.domain.com? do i need to request to create reverse proxy mapping so that point to ??