2

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet.

The web app exposes web services, and also does rendering of the HTML UI (ASP.NET MVC).

My plan is to install the application on our internal network, and expose the HTTPS port to the internet via a reverse proxy server which sits in the DMZ.

Is this a secure way to expose the web application? Or am I falling into some sort of trap?

Improve this question
4
  • +1 for the Skeletor avatar. Will the users of this system be predefined? In other words, will this application be used by random internet clients, or will it primarily be used by other businesses?
    – k1DBLITZ
    Commented May 12, 2015 at 15:06
  • It could be either. For random clients they would get logged on automatically by the back-end (anonymous user). For known users, they will authenticate either by providing credentials (over HTTPS) or single-sign-on (also done automatically by the back end).
    – RobSiklos
    Commented May 12, 2015 at 15:10
  • So would it be out of the question to have this site behind a VPN portal, or restrict access to allowed network segments?
    – k1DBLITZ
    Commented May 12, 2015 at 15:15
  • @k1DBLITZ Correct.
    – RobSiklos
    Commented May 12, 2015 at 15:16

1 Answer 1

Reset to default
4

You are not adding much security doing it this way alone: if an attacker can find a fault in your web app, using a reverse proxy alone will not prevent anything.

However, the fact that your reverse proxy is the place where the SSL connection is terminated allow you to add other security systems in between the final app and the user: it could be a WAF, an IPS/IDS or both.

Improve this answer
4
  • Let's assume that there is a WAF and IPS/IDS in place.
    – RobSiklos
    Commented May 12, 2015 at 14:46
  • Then you're allowing your WAF/IPS to check the traffic before it hits your application server and potentially block dangerous queries.
    – Stephane
    Commented May 12, 2015 at 15:02
  • Yes, so assuming those are in place, would you say that it's secure enough (assuming the web application itself is trusted)
    – RobSiklos
    Commented May 12, 2015 at 15:12
  • Secure enough for what ? The only thing you can say is that using a dedicated WAF system is probably more secure than not using one. Whether it's secure "enough" is a question of risk management which cannot be answered in general.
    – Stephane
    Commented May 12, 2015 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .