I have read, namely on Rackspace, that one should not use SSL termination for sensitive information (search the page for "SSL Termination should not be used"). Firstly, why would that be the case. Secondly, what in the world is the value of having SSL, if you can't trust that the data is securely transported?
My guess on the first question is that somebody could just add an
X-Forwarded-For header with an HTTPS URL, if they knew the direct IP of the server, bypassing the load balancer entirely, and coming in on port 80. I could overcome that via iptables (only allow port 80 from the load balancer), right?
Notes: My servers are in the same private network as the load balancer (regarding the "What are the security concerns?" note in that Rackspace article).