0

Say I've created my own web server from scratch. Very-very simple and vulnerable. I'm going to use it in production. Despite it being vulnerable, will it be feasible to run it with nginx and configure nginx as a reverse-proxy?

    Internet <-----> nginx <----------> my server

Will this mitigate the consequences since my own server won't be exposed to the internet but work internally.

  • yes, you could do that, with a lot of custom code to explicitly allow just what you want. it would likely be simpler to code all those rules/checks/validations in something simple like php and put that in front, then talk your naive server from php. if you just pass the request (attack) along with nginx, it doesn't help much. – dandavis Oct 7 '17 at 11:33
1

Very-very simple and vulnerable. I'm going to use it in production

I think you have highlighted your own issue right here.

You should never knowingly be deploying something in a production environment that you know is vulnerable.Trying to hide it behind Nginx is bordering on security through obscurity which is never a good practice.

Will this mitigate the consequences

No, you still have a knowingly insecure web backend. You cannot be sure it is not accepting direct connections or processing upstream packets from Nginx in a dangerous way.

Your best bet is to either not roll your own web server, or take some serious steps to build and secure it properly.

  • 1
    that's not true – Joichi Oct 7 '17 at 13:58
  • Ok. Best of luck with your deployment then. – Trickycm Oct 7 '17 at 14:07
  • 2
    @Joichi if you’re not going to listen to his answer why did you ask? Two people have told you this is a bad idea and still you are going ahead with this? – Sirens Oct 7 '17 at 17:03
  • @Sirens, relax. And go to bed, it's already late. – Joichi Oct 7 '17 at 17:11
2

"Maybe" and "sometimes" are the only answer you can get. nginx may stop malformed requests from reaching your vulnerable server however it'll only break on things it doesn't understand and kick out an error. An exploit can be entirely syntactically correct in which case nginx won't/can't protect you.

Without an in depth audit of your server code nobody will be able to know. If you're using this in an actual production environment you really ought to use a real web server framework because it's likely more secure.

  • ok, who will even be able to find ou what kind of server is behind nginx? – Joichi Oct 7 '17 at 8:52
  • @Joichi nginx doesn't hide the headers your server returns. If they realize that you're running a custom server (due to weird responses, fingerprinting, etc), it's just a slightly constrained black box problem. – Sirens Oct 7 '17 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.