Securing traffic handled with mod_proxy

Question

I have a machine running Apache and a Node.js server. Traffic is being routed through Apache using mod_proxy like so:

<VirtualHost *:443>
  ServerName example.com
  ProxyPass / http://localhost:3000 #Node.js application
  ...
  (cert info)
  ...
</VirtualHost>

And the Node.js server is started with:

http.createServer(app).listen(process.env.PORT || 3000)
// As opposed to https.createServer...

Since the initial request is made over HTTPS, is the traffic still secure even though it's being passed off to a presumably nonsecure application? I can't imagine the request would be exposed between Apache and Node, would it? My best guess is that, if all requests (even from Node to itself) are made through https://example.com they will be secure.

Answer 1

I can't imagine the request would be exposed between Apache and Node, would it?

Well, yes it is but the surface is small and no worse really than apache passing it off to another daemon (e.g. php-fpm) on the system.

Remember localhost (127.0.0.1) is the loopback interface on the system. If someone can snoop traffic on that interface, they are already on your system.