3

A client has a service that requires a bit javascript to be added to a customer's page. As a marketing tool to show prospective customers, I created a web app that demonstrates how the customer's page would look with my client's javascript. It's pretty cool and the sales team loves it!

The app uses a reverse proxy (mod_proxy) to make the customer's site appear to be on our domain, so the app can add the javascript without cross-site-scripting restrictions. It is now limited to authorized users.

This setup has worked well -- maybe too well! Now the CEO wants to make this tool available to anyone from their homepage. But as we all know...

Open reverse proxies are almost universally bad.

Is there any way to secure one in such a way as to make this demo app possible? I.e. to cripple it in ways that make it useless for spammers and hackers, but good enough to show a few demo pages to prospective customers?

Some ideas I've had

  • Only allow X number of files to be proxied per hour per IP address.
  • Limit to only handling GET requests
  • Do not set cookies
  • Keep a blacklist of domains not to proxy (Pay-per-click ad servers)
  • Inject warnings into page content ("This is not XYZ server") which are then removed by my application script.

Any other ideas, or is this a fool's errand?

1
  • You can prevent the proxy from going to any other domain other than the one you want to, by checking the host header and if it matches your client's domain to forward to that alone. It would then not be open anymore. May 23, 2021 at 1:32

1 Answer 1

0

Maybe it is sufficent to add a http authentication to your host. In this way your sales representative could easly show the demo page to the customers, but it should be unreachable for everyone else.

Don't forget to use https to avoid eardropping.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .