3

So, after reading Wikipedia's article on reverse SSL/TLS Proxies, I totally get the advantages it offers. But doesn't it also pose a security risk, by basically being a "man in the middle"?

As a client, I cannot see whether the reverse proxies just encrypts the traffic between the client and itself and forwards all requests to the webserver over HTTP or if it does encrypt both directions.

And another question: How can an SSL-Proxy achieve to break up a requested SSL/TLS connection, without being remarked either by the user nor by the TLS webserver itself?

Improve this question
5
  • 5
    A reverse proxy is deployed with the knowledge that the network behind it is secure. Assuming that is true, then it doesn't add additional risk, or at the very least the little risk it adds is outweighed by the advantages it offers (offloading TLS to a dedicated machine possibly with hardware acceleration, etc).
    – André Borie
    Jun 28, 2016 at 8:11
  • can you please elaborate on what you mean by "without being remarked either by the user nor by the TLS webserver itself?"
    – JOW
    Jun 28, 2016 at 14:28
  • 1
    @AndréBorie please post answers as answers, not comments. You've basically answered the question, but now it's gone out in the newsletter as "can you answer this?" because the system doesn't know.
    – derobert
    Jun 28, 2016 at 18:08
  • TLS termination proxy usually makes certificate management much easier because you only need to secure the TLS private key in one machine, instead of two hundred, if you're load balancing.
    – Lie Ryan
    Jun 29, 2016 at 6:16
  • Note that not all TLS reverse proxy are TLS termination proxy. It's possible that a TLS reverse proxy just direct traffic to their destination based on SNI, but not decrypt the traffic.
    – Lie Ryan
    Jun 29, 2016 at 6:18

1 Answer 1

Reset to default
3

In most cases in which a reverse proxy is deployed, the network behind it is assumed to be secure, in which case the fact that there is technically a man-in-the-middle is of no consequence.

However, some providers that use a reverse proxy do choose to secure the traffic behind the proxy using an IPSEC tunnel between the proxy and the content server(s). That way, the processing overhead of managing certificates, handling termination, and blocking unwanted traffic can still be done on the proxy server at the edge of the network, but a network compromise will still reveal no information.

Improve this answer
2
  • Are there risks if an insecure (http port 80) application behind a reverse proxy uses OAuth authentication from providers like Google, Facebook, Twitter, GitHub or Azure AD?
    – Shawn Eary
    Aug 7, 2020 at 18:50
  • @ShawnEary It still comes down to the same question - do you trust your internal network or not? The risks to an OAuth application are no different than any other application that handles secrets.
    – Moshe Katz
    Aug 7, 2020 at 19:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .