0

I wonder if mod_proxy is a good practice because i have an apache http server which delvier my application ressources html/css/jss and for specific url I use ProxyPass to external IP. By example url like: a.example.com/index.html load ressources from c:/htdocs/a/index.html etc...

But for all url ending with /api I have ProxyPass configuration by example for a.example/api/ I have ProxyPass /api http://external-server-ip.com:8802/api connectiontimeout=10 timeout=2400

All this works, but I doubt if this is good practice? because actually it seems all my REST /api/... requests go through apache then apache send them to http://external-server-ip.com:8802/api then this external server send response to apache then apache respond to me ? This seems heavy and bad no ?

Is this common behavior: keep same domain name + load ressource from same http-server but for all REST request send+fetch proxypass to external ip depending on "subdomain"

UPDATE: I proxypass /api all to different of my BACKEND-servers which are installed on different cloud server (theses servers are mine), but I just want one domain name to all my clients to be client-name.MYURL.com

I have some clients on cloud-server-1 and others in others cloud-server-2, by example:

client-1.MYURL.com/api until client-1000.MYURL.com/api are proxypassed to a cloud server ip x.x.x.x:x

and client-1000.MYURL.com/api until client-2000.MYURL.com/api will fetch data from cloud-server ip y.y.y.y:y

and so on ... another uecase is I want create accès to my local-server-test just by accessing test.MYURL.com which have ip z.z.z.z:z

Here all external-ip are my backend-server on different places/machines/server.

And I use mod_macro to achieve this by creating virtualhost per client, this all works, the questio is best practice and how keep only ONE domaine name but redirect to selected server depending on subdomain, this allow me to have only ONE domain name + one wldcard ssl certificat etc. for all my clients

1 Answer 1

0

It's proper separation of concerns and generally best practice to run a normal web server in front of your app servers.

Your app server is generally written to serve a specific business purpose, and adding unnecessary things to it is usually considered a waste of time and money unless there is a compelling reason why a web server can't be used. (This is rare but it does happen, which is why most languages/web frameworks have middleware for things like TLS.)

The web server itself is much more full featured and can do a variety of things that you would otherwise have to add to your app server, or which the web server can simply do better, such as IP-based access control, WAF, serving static assets, caching, basic load balancing, and many more.

What is unusual is proxy passing to an app server that isn't under your control, or via a network that isn't under your control. If you are loading things over the Internet or some other untrusted network, you really should be using HTTPS. This is one situation in which the app server really needs to include TLS middleware.

7
  • i just updat my question, please check UPDATE section all these proxypass baeed on subdomain are calling MY backend-server isntalled on different machine
    – ebeg
    Aug 5, 2020 at 11:10
  • @ebeg OK, if you control the network between them, then there's nothing else to do. Aug 5, 2020 at 11:32
  • what you mean by " then there's nothing else to do", i'm looking best practice to achieve this to resume : have one domaine name + one ssl certfiicate but depending on subdomain make API call to specific external server-ip, thank you
    – ebeg
    Aug 5, 2020 at 11:37
  • @ebeg It sounds like you run the API servers but they are on different cloud providers, thus you don't control the network. In this case your API servers need to use TLS. I updated the answer to reflect this. Aug 5, 2020 at 11:39
  • please apologize i do not understand what you mean and why you talking about TLS, i control apache server and i want see if sending request to apache server + apache proxy it to another external ip is good practice ? or can request be redirected to specific server without going/transiting trough apache, i go on a.myurl.com and all API request are going directly to my external.ip without apache, (ps all my servers communicate over https/wss)
    – ebeg
    Aug 5, 2020 at 11:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .