2

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet.

The web app exposes web services, and also does rendering of the HTML UI (ASP.NET MVC).

My plan is to install the application on our internal network, and expose the HTTPS port to the internet via a reverse proxy server which sits in the DMZ.

Is this a secure way to expose the web application? Or am I falling into some sort of trap?

  • +1 for the Skeletor avatar. Will the users of this system be predefined? In other words, will this application be used by random internet clients, or will it primarily be used by other businesses? – k1DBLITZ May 12 '15 at 15:06
  • It could be either. For random clients they would get logged on automatically by the back-end (anonymous user). For known users, they will authenticate either by providing credentials (over HTTPS) or single-sign-on (also done automatically by the back end). – RobSiklos May 12 '15 at 15:10
  • So would it be out of the question to have this site behind a VPN portal, or restrict access to allowed network segments? – k1DBLITZ May 12 '15 at 15:15
  • @k1DBLITZ Correct. – RobSiklos May 12 '15 at 15:16
4

You are not adding much security doing it this way alone: if an attacker can find a fault in your web app, using a reverse proxy alone will not prevent anything.

However, the fact that your reverse proxy is the place where the SSL connection is terminated allow you to add other security systems in between the final app and the user: it could be a WAF, an IPS/IDS or both.

  • Let's assume that there is a WAF and IPS/IDS in place. – RobSiklos May 12 '15 at 14:46
  • Then you're allowing your WAF/IPS to check the traffic before it hits your application server and potentially block dangerous queries. – Stephane May 12 '15 at 15:02
  • Yes, so assuming those are in place, would you say that it's secure enough (assuming the web application itself is trusted) – RobSiklos May 12 '15 at 15:12
  • Secure enough for what ? The only thing you can say is that using a dedicated WAF system is probably more secure than not using one. Whether it's secure "enough" is a question of risk management which cannot be answered in general. – Stephane May 12 '15 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.