Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the security of the website? I have seen this claim, but I can't see a reason why this (functionality beyond load balancing) would be the case.
1 Answer
Just putting a simple load balancing reverse proxy in front of a broken web application does not fix it. It will implicitly some kind of sanitize HTTP requests at the protocol level, but it will not protect against any security issues at the web application level, like SQL injection, local file inclusion etc. It will also not protect against uploading malicious files.
Note though that are reverse proxies which can actually help. A Web Application Firewall (WAF) is usually a reverse proxy too. Common reverse proxies like nginx or Apache can be extended with functionality to filter traffic and even add WAF functionality. But this is functionality which needs to be explicitly added or configured.
answered Oct 1 at 18:56
-
So nginx/Apache are useful for certain types of security, namely: 1. protocol-level HTTP request cleaning and 2. as a starting point to configure various firewalls/traffic filtering. Do you have an example/definition of protocol-level HTTP request attacks? I've only heard of app-level issues like SQL injection. Oct 1 at 19:42
-
@BigMistake: Attacks at the protocol level are for example DoS by slowly sending the header, which can be handled by something like nginx usually better because of a lower overhead per connection. This can be attacks like HTTP request smuggling which most servers don't protect from that much though. It might be just sending unexpected garbage against the server, very large HTTP headers, ... which might be a problem for a HTTP stack which is not designed for robustness but just makes assumptions about the protocol which are not guaranteed with a malicious sender. Oct 2 at 4:53