0

Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the security of the website? I have seen this claim, but I can't see a reason why this (functionality beyond load balancing) would be the case.

1
  • 1
    Compare this to a web server software that you would have done yourself. A combo of well known, comunity maintened, industry tested server software is better. They have fewer errors and faster patching capabilities. This is going to reduce the potencial attack surface. Also it will generate a faster incident response. But it dosen't mean that your ops will configure and secure them.
    – v-g
    Feb 24 at 10:43

1 Answer 1

1

Just putting a simple load balancing reverse proxy in front of a broken web application does not fix it. It will implicitly some kind of sanitize HTTP requests at the protocol level, but it will not protect against any security issues at the web application level, like SQL injection, local file inclusion etc. It will also not protect against uploading malicious files.

Note though that are reverse proxies which can actually help. A Web Application Firewall (WAF) is usually a reverse proxy too. Common reverse proxies like nginx or Apache can be extended with functionality to filter traffic and even add WAF functionality. But this is functionality which needs to be explicitly added or configured.

2
  • So nginx/Apache are useful for certain types of security, namely: 1. protocol-level HTTP request cleaning and 2. as a starting point to configure various firewalls/traffic filtering. Do you have an example/definition of protocol-level HTTP request attacks? I've only heard of app-level issues like SQL injection.
    – BigMistake
    Oct 1, 2023 at 19:42
  • @BigMistake: Attacks at the protocol level are for example DoS by slowly sending the header, which can be handled by something like nginx usually better because of a lower overhead per connection. This can be attacks like HTTP request smuggling which most servers don't protect from that much though. It might be just sending unexpected garbage against the server, very large HTTP headers, ... which might be a problem for a HTTP stack which is not designed for robustness but just makes assumptions about the protocol which are not guaranteed with a malicious sender. Oct 2, 2023 at 4:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .