What security concerns exist in running a glassfish app directly on port 443

Question

I have installed Apache http server in front of glassfish based on recommendations i had in this question.

I have been told that i will run into performance problems along with security issues. I was able to make Apache handle port 80 connections. However i had some problems concerning https, see my Other question.

Now that my application itself directs to Https (using CONFIDENTIAL in web.xml) and not apache, is there a security issue if i make glassfish run its http-listener-2 on port 443 directly?

What is happening now is:

• i type: www.adomain.com
• since application runs on root context, url becomes: https://www.adomain.com:8181

so the flow is: www.adomain.com:80 --> Apache --> Glassfish root context app (app forces https)

i do not want to show the port 8181 in the url. I tried several methods (mod_rewrite, disabling port 80 so that only 443 runs,etc..) but nothing was working.

If i set http-listener-2 in glassfish to run on 443, port 8181 won't show in the URL.

I have no experience in server admin and it's beyond my expertise, but since this is a personal project i have to do the server tasks.

Excuse my maybe basic question but how unsecure is it to run directly on port 443 and why?

Answer 1

You need your Java app to work in e.g. context like http://www.example.com/something/ on port 80 on the local ip number e.g. 127.0.0.1 and apache listening on public ip 1.2.3.4 port 80 and forwarding the requests to the 127.0.0.1 and even without /something you should not have issues.

You can drop mod_security to apache to even further improve security.