0

I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with a Node.js application. The requests to the back-end would then be proxied to the back-end application inside the Node.js application. On both sides an HTTPS-secured server is used.

There is a tool called http-proxy-middleware which is able to create a proxy for all requests to the back-end server. I'm using the following script:

var express = require('express');
var proxy = require('http-proxy-middleware');

var options = {
    target: 'https://[server]',
    changeOrigin: true,
    secure: true
};

var exampleProxy = proxy(options);
var app = express();

app.use('/api', exampleProxy);
app.use(express.static(__dirname + "/public"));
app.listen(process.env.PORT || 8080);

As the connection is made over HTTPS and the back-end server is only accepting HTTPS requests, I'm expecting, that this method is secure. But is it? Is there a possible attack vector? Is it possible that the implementation of the http-proxy-middleware leaks data through the HTTPS communication?

  • Is there a reason not to just use private networking for the backend and have the frontend server side do the fetching of the backend server? – Trickycm Sep 12 '17 at 19:05
1

In your use case if the TLS is good implemented I don't see any problem.

Sure the most secure way is VPN and full ipsec but I don't know the functionality of your app so maybe it's an overkill.

How all security guys says "It depends" how sensible and interesting is your data on wire.

Anyway I suggest to look in a bit in source code of http-proxy-middleware. What when Node.js is in the question I allways look in source code of packages to prevent possible memory leaks and security leaks.

As Node.js user I suggest to use on every project before deploy https://snyk.io/ it's optional but I do it so I can sleep better and full trust I have only in my code :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.