Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Say I've created my own web server from scratch. Very-very simple and vulnerable. I'm going to use it in production. Despite it being vulnerable, will it be feasible to run it with nginx and configure nginx as a reverse-proxy?
Internet <-----> nginx <----------> my server
Will this mitigate the consequences since my own server won't be exposed to the internet but work internally.
"Maybe" and "sometimes" are the only answer you can get. nginx may stop malformed requests from reaching your vulnerable server however it'll only break on things it doesn't understand and kick out an error. An exploit can be entirely syntactically correct in which case nginx won't/can't protect you.
Without an in depth audit of your server code nobody will be able to know. If you're using this in an actual production environment you really ought to use a real web server framework because it's likely more secure.
Very-very simple and vulnerable. I'm going to use it in production
I think you have highlighted your own issue right here.
You should never knowingly be deploying something in a production environment that you know is vulnerable.Trying to hide it behind Nginx is bordering on security through obscurity which is never a good practice.
Will this mitigate the consequences
No, you still have a knowingly insecure web backend. You cannot be sure it is not accepting direct connections or processing upstream packets from Nginx in a dangerous way.
Your best bet is to either not roll your own web server, or take some serious steps to build and secure it properly.
