4

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container.

The app will deal with sensitive financial data, so security is top priority. The app is expected to handle a very heavy load, with tens of thousands of requests being sent to it per second.

If there is a significant security boost, then security takes priority over speed. The logic is simple: If I have a serious breach and lose the faith of my customers/investors, an extra 500ms in load time won't help me.

I already consulted with a security expert at a well-known company in San Francisco, and they recommended using Jetty.

They advised that while there would be a performance drop from Apache Tomcat, the security gains were so significant that it was worth it. They also recommended Jetty over Nginx. They said that Apache and Nginx were written in C, and as such, contained more security vulnerabilities than a server written in an interpreted language like Java.

They also advised me not to use a web server in languages like Python and Ruby, citing potential security flaws.

I then learned that Google App Engine switched from Apache Tomcat to Jetty for their web server/servlet container, and that strengthened the argument. InfoQ article - Why Google Chose Jetty

So while there seemed to be a lot of strong arguments going for Jetty (security expert's suggestion, Google's choice), I wanted to open this discussion up to the InfoSec community on Stack Exchange.

In your opinion, which of the following is the most secure, if we ignore for a minute the app code that is written on top of it?

  • Jetty
  • Apache Tomcat
  • Nginx
  • Python/Ruby based Web Server
  • Node.js Web Server
  • others that I haven't mentioned

closed as primarily opinion-based by Steffen Ullrich, Mike Ounsworth, Ohnana, Rory Alsop Apr 30 '16 at 21:42

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This all sounds valid, but I expect other factors in your app will affect security far more than choice of web server. – paj28 Sep 19 '15 at 21:09
  • 2
    "Apache and Nginx were written in C, and as such, contained more security vulnerabilities than a server written in an interpreted language like Java" -- while it might be true that Apache and Nginx have more vulnerabilities than Jetty (I have no idea about whether or not that is true), the argument "java is better than c in terms of security" is flawed: the JVM is not guaranteed to be bug-free and most JVMs are partially implemented in c/c++. It boils down to the quality of the code, it is merely easier to make mistakes in c/c++. So for Jetty, your next question is which JVM to choose ;) – dst Sep 20 '15 at 2:34
  • 1
    "which technology would you choose" is a really subjective question. This might get closed as "opinion-based". – schroeder Sep 20 '15 at 3:13
  • 1
    Jetty has had a recent vulnerability: blog.gdssecurity.com/labs/2015/2/25/… Apache had many vulns in the past but a good record in the past 10 years. for security, choice of web server matters little – paj28 Sep 20 '15 at 6:40
  • 2
    Apache httpd is written in C, but Tomcat is Java, except optionally the (pretty small) "native"/APR option for SSL/TLS. And even granting JVM (almost always) catches low-level flaws like buffer overrun and dangling pointer, in recent years most web vulnerabilities are at protocol and application levels like compression, header splitting, cookies, crypto, XSS, XSRF, SQL injection, etc, which don't depend on language as such, but often depend on server and/or framework which implies a language. – dave_thompson_085 Sep 20 '15 at 14:09