0

Say I've created my own web server from scratch. Very-very simple and vulnerable. I'm going to use it in production. Despite it being vulnerable, will it be feasible to run it with nginx and configure nginx as a reverse-proxy? 

    Internet <-----> nginx <----------> my server

Will this mitigate the consequences since my own server won't be exposed to the internet but work internally.

Improve this question
1
  • yes, you could do that, with a lot of custom code to explicitly allow just what you want. it would likely be simpler to code all those rules/checks/validations in something simple like php and put that in front, then talk your naive server from php. if you just pass the request (attack) along with nginx, it doesn't help much.
    – dandavis
    Oct 7, 2017 at 11:33

2 Answers 2

Reset to default
2

"Maybe" and "sometimes" are the only answer you can get. nginx may stop malformed requests from reaching your vulnerable server however it'll only break on things it doesn't understand and kick out an error. An exploit can be entirely syntactically correct in which case nginx won't/can't protect you.

Without an in depth audit of your server code nobody will be able to know. If you're using this in an actual production environment you really ought to use a real web server framework because it's likely more secure.

Improve this answer
2
  • ok, who will even be able to find ou what kind of server is behind nginx?
    – Joichi
    Oct 7, 2017 at 8:52
  • @Joichi nginx doesn't hide the headers your server returns. If they realize that you're running a custom server (due to weird responses, fingerprinting, etc), it's just a slightly constrained black box problem.
    – Allison
    Oct 7, 2017 at 17:13
1

Very-very simple and vulnerable. I'm going to use it in production

I think you have highlighted your own issue right here.

You should never knowingly be deploying something in a production environment that you know is vulnerable.Trying to hide it behind Nginx is bordering on security through obscurity which is never a good practice.

Will this mitigate the consequences

No, you still have a knowingly insecure web backend. You cannot be sure it is not accepting direct connections or processing upstream packets from Nginx in a dangerous way.

Your best bet is to either not roll your own web server, or take some serious steps to build and secure it properly.

Improve this answer
4
  • 1
    that's not true
    – Joichi
    Oct 7, 2017 at 13:58
  • Ok. Best of luck with your deployment then.
    – TrickyDupes
    Oct 7, 2017 at 14:07
  • 2
    @Joichi if you’re not going to listen to his answer why did you ask? Two people have told you this is a bad idea and still you are going ahead with this?
    – Allison
    Oct 7, 2017 at 17:03
  • @Sirens, relax. And go to bed, it's already late.
    – Joichi
    Oct 7, 2017 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .