1

The situation is the following:

I have two servers running on my machine. One being an outwards facing server while being a reverse proxy for the second one, which only listens on localhost and provides a service.

The second server is supposed to run over https. I know see two options:

  1. Just implement https on the second server, and have the reverse proxy serve the https package to it.
  2. Implement the https logic in the reverse proxy and "abstract https away" for the second server.

I don't even know if both of these options are possible, let alone viable. If so, what are the advantages and disadvantages of both solutions?

EDIT: In this scenario, the reverse proxy is nginx, and the service providing server is a Node.js server.

3
  • 2
    Just implement https on that server "facing outwards". Applying https on your second server does make thing more complicate.
    – Orphans
    Aug 31 '17 at 13:46
  • 1
    As you are coming from Germany and I myself work for a German company: security officers in Germany often like to see encryption everywhere that means even between those two components. But I agree with Orphans that this makes your setup more complicated. But imagine what happens if you later on need to put the components on different hosts. So preparing for encryption from the beginning might be a good idea too. To answer your question better: what servers are we talking about ? haproxy / nginx / apache / ... ?
    – Marged
    Aug 31 '17 at 13:57
  • @Marged I made an edit
    – hgiesel
    Aug 31 '17 at 14:03
2

I recommend your scenario two. It is good practice to have a dedicated server handle the ssl / tls stuff.

When your software design starts to get more broad you perhaps will need load balancing between two NodeJS instances. In that case it is easier to have session stickyness and similar stuff when the reverse proxy can look inside the transferred data (which it is only able to when it does the encryption itself)

If you expect that your design will change and that the reverse proxy and the NodeJS instance will be moved to separate servers you should plan for encryption from the beginning because otherwise you will transfer unencrypted data over a network.

As we are both located in Germany: I often see software written without support for encryption which causes major problems when used in an environment where German security officers demand for 100% encryption, even if you are "only" transferring session data. So depending on what your plans are you should think twice which you rate higher: simplicity or security.

4
  • You don't need to build encryption into every software. VPNs etc. are made for that, and it's quite possible to run a VPN inside a datacenter between hosts. This way, multiple software is able to use transport encryption, and you don't have to alter / configure each software on it's own.
    – gxx
    Aug 31 '17 at 16:04
  • @gf_ you are correct, this is an option and you could even do this on hardware level by adding encryption on the physical network layer. But I have seen ISOs rank this as less secure because the encryption starts later than technically possible. And in addition to this it makes a difference when there is the demand to add mutual authentication to components talking to each other.
    – Marged
    Aug 31 '17 at 21:29
  • Re: "[...] less secure because the encryption starts later than technically possible [...]": Yeah, but if the host is compromised anyway, then there isn't a difference, IMHO. If it's not, I don't see the difference. Re: "[...] demand to add mutual authentication to components talking to each other.": "mutual authentication" is something like client certs, for example?
    – gxx
    Sep 1 '17 at 10:46
  • @gf_ I am only reporting the point of view of paranoid ISOs ;-) The system does not need to be compromised: an administrator with logon permissions could sniff data. And yes: I meant client certificate based authentication, in that scenario one for each component. In a VPN you would have this only for every network interface
    – Marged
    Sep 1 '17 at 19:27
0

Doing the https in the proxy has another advantage: you can move parts of the site to different servers later, while keeping one user-facing domain and one certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.