I have a back-end and a front-end application which are running on two different servers (hosts). To prevent using CORS and simplify the communication, I would like to serve the static front-end with a Node.js application. The requests to the back-end would then be proxied to the back-end application inside the Node.js application. On both sides an HTTPS-secured server is used.

There is a tool called http-proxy-middleware which is able to create a proxy for all requests to the back-end server. I'm using the following script:

var express = require('express');
var proxy = require('http-proxy-middleware');

var options = {
    target: 'https://[server]',
    changeOrigin: true,
    secure: true

var exampleProxy = proxy(options);
var app = express();

app.use('/api', exampleProxy);
app.use(express.static(__dirname + "/public"));
app.listen(process.env.PORT || 8080);

As the connection is made over HTTPS and the back-end server is only accepting HTTPS requests, I'm expecting, that this method is secure. But is it? Is there a possible attack vector? Is it possible that the implementation of the http-proxy-middleware leaks data through the HTTPS communication?

  • Is there a reason not to just use private networking for the backend and have the frontend server side do the fetching of the backend server? Sep 12, 2017 at 19:05

1 Answer 1


In your use case if the TLS is good implemented I don't see any problem.

Sure the most secure way is VPN and full ipsec but I don't know the functionality of your app so maybe it's an overkill.

How all security guys says "It depends" how sensible and interesting is your data on wire.

Anyway I suggest to look in a bit in source code of http-proxy-middleware. What when Node.js is in the question I allways look in source code of packages to prevent possible memory leaks and security leaks.

As Node.js user I suggest to use on every project before deploy https://snyk.io/ it's optional but I do it so I can sleep better and full trust I have only in my code :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .