Hi I have a WebApp where security is important. E.g.
www.somewebapp.com
The app has a wordpress blog (hence not secure since wordpress). e.g.
www.somewebapp.com/blog
To protect the webapp from the insecure blog, the blog is hosted on a separate server.
We use nginx reverse proxy to redirect all /blog queries to the blog server.
My question does this mean the webapp is fully protected from the insecure blog?
My concern is especially re: Sessions. Since the domain for blog and webapp is the same they would share the same sessions?
If blog server is compromised would an attacker be able to obtain the session data that is valid for the webapp? Could he do something malicious with that?
For additional info, I use the below config nginx for redirecting blog queries.
location /blog {
proxy_pass https://blog_ip:port;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}