Are there security issues configuring Apache as an HTTPS reverse proxy to an ASP.NET Core non-SSL application?

user_2876648 0
Viewed 611

I am not certain this is ready to be brought into a production environment.
Essentially, I have an SSL certificate for my public URL (https://*.example.com) but my ASP.NET Core 2.1 application (and a Kestrel service configured only on port 5000) has never been configured to use HTTPS.

In Apache I configured a virtual host to redirect requests from port 80 to 443, then another one for reverse-proxying port 443 (incoming) to 5000 on the backend:

# Force usage of https for public requests
<VirtualHost *:80>
        ServerName aspnet01.example.com
        Redirect / https://aspnet01.example.com
</VirtualHost>

<VirtualHost *:443>
        ProxyPreserveHost On
        ProxyPass / http://127.0.0.1:5000/
        ProxyPassReverse / http://127.0.0.1:5000/
        ServerName aspnet01.example.com
        ServerAlias *.example.com
        ErrorLog /opt/bitnami/apache2/logs/aspnet01_error.log
        CustomLog /opt/bitnami/apache2/logs/aspnet01_access.log combined
</VirtualHost>

And on the firewall there are only two ports open, 80, 443 and 22 for server administration. I'm wondering what are the risks on publishing my app this way, I trustfully rely on the fact that traffic from outside is encrypted and nobody is sniffing my internal network.

More generally, is it enough to put an old application (that doesn't use HTTPS) behind a reverse proxy, to consider it secure?

I'm using LAMP on Ubuntu 16.04. Thanks in advance.

ubuntu-16.04 asp.net-core ssl apache
1 Answers

The Kestrel app will only be as secure as your reverse proxy configuration and network is, but that's generally an acceptable way to handle security, as it reduces the overhead within your network between Kestrel and the reverse proxy.

Per Microsoft's documentation:

A reverse proxy:

  • Can limit the exposed public surface area of the apps that it hosts.
  • Provide an additional layer of configuration and defense.
  • Might integrate better with existing infrastructure.
  • Simplify load balancing and secure communication (HTTPS) configuration. Only the reverse proxy server requires an X.509 certificate, and that server can communicate with the app's servers on the internal network using plain HTTP.

https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1#when-to-use-kestrel-with-a-reverse-proxy

user_133742790
Related