0

I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, goes to URL like it got example.com from ../proxy/example.com, and now takes the HTML (Page source code) from that website and using Flask sends that HTML as response to ../proxy/www.example.com.

Now here is the security question

While doing all these things, websites don't load their data just from a single request; some load data using JavaScript, Ajax and using other stuff client-side. If a website is loading data client side, then they may go directly to the website, that means they don't go through proxy. Is that a security issue or not, because on requesting the website directly the user may leak their IP address, the website may save their cookies on user's browser and other things also. Is there any idea to solve this issue if it is issue? And if it is not issue, then why not, because connecting directly to website mean user can leak their IP address to the website and while connecting directly to website, the website can save their cookies in their website. They save cookies in our website or in their website because it is connected from /proxy/<URL>. No, I don't mean through proxy but I mean while connecting directly to website they are under my website like they are in /proxy/example.com and then it is connected into their website.

Improve this question

1 Answer 1

Reset to default
1

The general concept introduces a big security issue, since this way all domains are merged into the single domain of the proxy. Any protection which relies on the concept of a separate origin per domain (i.e. same origin policy, cookie policy, CORS, CSP ...) will cease to exist, since the browser sees everything as being in the same origin.

On top of this issue come the problems you mention, i.e. direct access bypassing the proxy. There is no solution while keeping your design. Instead use a real HTTP or SOCKS proxy instead which is configured inside the browser. This way the browser will use this proxy for all outgoing requests (and thus hiding the source IP address) while still keeping different domains as different origins.

Improve this answer
10
  • Explanation about HTTP or SOCKS proxy? and How can I get access to users browser to do these proxy things!
    – imxitiz
    Jul 11, 2021 at 17:37
  • @Kshitiz: "How can I get access to users browser to do these proxy things!" - The proxy is explicitly configured by the user themselves, same way the user explicitly used your URL as an entry point for every web browsing. "Explanation about HTTP or SOCKS proxy?" - not sure what you want to know here: what this is, how to use, how to implement, .... ?
    – Steffen Ullrich
    Jul 11, 2021 at 17:43
  • OK! then I don't think it will help me, but please provide me the reference article about it to understand basics of this then I will know it will helpful for me or not.
    – imxitiz
    Jul 11, 2021 at 17:47
  • @Kshitiz: Since I still don't know what you want to know I can only give you some generic resource - here is the link to the relevant topic on Wikipedia.
    – Steffen Ullrich
    Jul 11, 2021 at 17:49
  • 1
    @Kshitiz: startpage uses different sub-domains and thus different origins which somehow eliminates the problem I described, except for cookies. But they also remove all cookies from the traffic which handles the rest of this problem. They also employ elaborate rewriting of content and replacing of Javascript functions to address the problem you mentioned with direct access. They probably successfully handle the common cases but I would not rely on it to fully protect the IP address.
    – Steffen Ullrich
    Jul 11, 2021 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .