3

So, our proxy server blocks all traffic except approved ones.

Would allowing a URL shortening (aka.ms, for example) mean any URL will bypass the proxy? Or is it just a redirect and the proxy/security system inspects the original URLs (whitelisted or not)?

Can we still be safe to allow the traffic to go to aka.ms?

3
  • 1
    is the client behind a proxy, or is the proxy in front of the server? (or, asked in a different way: is the url shortener on the same side as the client, or as the server?)
    – njzk2
    Feb 26 at 20:46
  • A url shortening (and expansion :P) service is a redirector, not a proxy.
    – Bergi
    Feb 27 at 0:42
  • 1
    What is your proxy server supposed to protect? The client from shoddy websites, or the webserver from malicious clients?
    – Bergi
    Feb 27 at 0:52

1 Answer 1

4

A "proxy" can have different meanings. It might be a reverse proxy protecting a specific site, like a web application firewall or a content delivery network (CDN). A proxy might also be some (usually corporate) proxy which limits what sites clients behind the proxy can access. I will discuss both options here.

Server side reverse proxy, limiting access within site

A URL shortener like aka.ms is just doing a HTTP redirect. But even if the URL shortener would access the resource directly (i.e. working as proxy, not redirect) it would need to use the original URL, since otherwise it would not get the resource. So from the perspective of your proxy the resource will always be accessed with the original URL.

But this has nothing to do with "bypassing" the proxy. A bypass is only possible if the server behind the proxy is a) directly accessible from the client in the first place and b) the client or URL shortener actually knows the URL and IP address for direct access. A proper protection would make sure that the server is not directly reachable by some external client but only reachable by the security proxy.

Client side access proxy, limiting which sites client can access

As stated before, common URL shorteners are doing a redirect and thus the actual access to the original URL is done directly by the client. This means this access will also pass through the client side proxy and any restrictions here will be applied.

While it might be possible to create a URL shortener which works as a proxy itself, this would require the URL shortener to rewrite any traffic passing through in order to stay in path of the traffic, i.e. any references to embedded content, any links, any dynamically accessed content through Javascript. This would not only be very hard to do reliably (especially with Javascript) but also be dangerous since when access to every site is served within the same shortener domain the same origin policy no longer has any effect. Therefore no sane URL shortener which focuses on the shortener functionality would work this way - it is just too much effort and too much gets broken.

In other words, no client site proxy bypass with common URL shorteners.

2
  • "from the perspective of your proxy" - it's not quite clear to me whether the OP is talking about a reverse proxy (between the internet and their resource server) or a web proxy (between the client(s) and the internet).
    – Bergi
    Feb 27 at 0:50
  • @Bergi: good point. I've now covered both interpretations of "proxy". Feb 27 at 2:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .