This question already has an answer here:
I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL only on the frontend and leave the backend connection unsecured. In other words, the reverse proxy is the TLS termination point.
Why is there no security concern on leaving the backend unsecured?
If a malicious client happens to know the address/port of a backend service, can't they connect to it directly without having a valid cert and isn't this a huge security risk?