Is a reverse proxy worth it?

Question

Is a reverse proxy worth it? There are so many unsecured sites using a reverse proxy and I feel like that doesn't protect them. After all if they have an error in their SQL that could be use for injection, right? I feel like too many people rely on reverse proxy without knowing how to program correctly

Answer 1

I'd like to first specifically comment on this statement -

"There are so many unsecured sites using a reverse proxy and I feel like that doesn't protect them."

Just because you see some site is using X or Y CDN/WAF, it doesn't mean they have some/any security. Some use free/cheap-tier plans that offer partial security, and others don't turn ON certain WAF features (even if paid for).

Like any security measure, virtual or physical, Web Application Firewalls (via reverse proxy or any other deployment format) aren't a silver bullet.

It doesn't mean you shouldn't use them, on the contrary! Using a proper Cloud WAF helps you avoid very common pitfalls many websites suffer from:

1. 3rd-party code - You might be writing some kick-*** code, but what about the 3rd party libraries you use? What about servers running WordPress/Joomla/Drupal/Magento/…?

   You can't be responsible for every piece of code that your system runs, and time-to-patch is critical. A proper Cloud-WAF provider gives you virtual patching that’s magnitudes faster and more reliable than a panicking siteop.

2. Lower-level vulnerabilities - Remember Heartbleed? Shellshock? POODLE?

   How long does it take you to deploy OS-level patching? In some cases, if it's more than a couple of hours, good chances you're compromised.

3. DDoS Mitigation - Hopefully everybody understand by now, that you can only completely mitigate DDoS using a cloud scrubbing service. (And no, AWS is NOT a scrubbing service).

4. Filtering out abusive visitors - Comment Spam, Referrer Spam, Scraping, etc.

   Things that, unfortunately, have anything to do with your ability to "program correctly". Cloud-sourced client classification and reputation gives you that.

5. Security at the edge – Not only content caching! You can offload many heavy-lifting and hassles to the edge.

   • Want to require 2FA and/or CAPTCHA on certain pages? Deliver them from the edge.
   • Want to block certain IPs? Filter at the edge.
   • Don’t want visitors from outside the UK? Filter at the edge.
   • Don’t want Firefox from Iran accessing /login more than 5 times per minute? You guessed it, Filter at the edge.

That’s just to give you a taste, there are many more great things a CBSP can give you (we haven’t discussed visibility at all).

Disclosure: I work @ Imperva Incapsula, a CBSP which provides Cloud WAF/DDoS Mitigation/CDN/GSLB.

Answer 2

Ultimately, securing a system does not necessarily mean making it impossible to break into, as that's pretty much impossible. Instead, the goal often is to make it difficult enough that potential hackers would need an immense amount of resources to do it, so they either don't bother trying or move on to easier targets. Web Application Firewalls are just another tool to help you accomplish this. They are capable of detecting a pretty wide range of attacks including SQL and XSS injection, and while there are ways to bypass them, it would take a pretty determined attacker to do so. Thus, a WAF can play a very useful role in a multi-layered, defense-in-depth strategy.

You are right, though, in that a WAF is not invincible and should not be an excuse to write insecure code, just as getting a vaccine should not be an excuse to not wash your hands. It should be treated only as a last line of defense and developers should not assume that the WAF will protect against all vulnerabilities.

Regarding CloudFlare, I believe their free plan is mainly meant for CDN/caching and only provides protection against DDoS and basic web application attacks. They require a paid plan for a more sophisticated WAF.

(And just to clarify terminology, I assume you're talking about a WAF and not just a reverse proxy. Though a WAF can be combined with a reverse proxy to protect many servers/sites at once (e.g. CloudFlare), a WAF can be set up without a reverse proxy and vice versa. Like others have said, reverse proxies are often used only for caching/performance purposes.)

Answer 3

The primary benefits of a reverse proxy are better performance, capacity and traffic management. There is a small security benefit in that it provides some isolation for your application - only valid http will likely get as far as your webserver, and it should better handle sloloris type attacks. Most such proxies allow for applying some smarts to the requests, often without having to take the service offline, allowing for a response to a prolonged attack on your server.

A CDN adds additional performance benefits if it properly implements geo aware DNS (a lot still don't).

You certainly shouldn't be any less secure using a reverse proxy, and for most people the primary benefits justify the cost/effort.

Answer 4

Did you mean web application firewall instead of reverse proxy?

The primary reason to use a reverse proxy is usually performance bound such as caching or load balancing. It often has the added benefit of stopping attacks like slow loris as the reverse proxy will require a completed request before passing it on to the back end web server. This is more of a side effect and not a security feature of the reverse proxy however.