send data from a server to browser to another server

user_2690277 0
Viewed 112

I have 2 servers lets name them serverA and serverFirebase

serverA has no internet access and only accessible in a local network and it hosts a .net application

serverFirebase is google firebase server

i need to send a request from serverA to serverFirebase but i can't because serverA has no internet access

the solution that came to my mind is that since the browser (that shows the web app from serverA) has internet access i could proxy my request using his browser

so it would be like this

serverA -> browser -> serverFirebase

now the way that i wanna do this is like this:

1 - create a rsa key pair and have the private key in serverA and the public key in serverFirebase

2 - in serverA create a sha256 hash of the request payload and padd it and sign it using the priavte key (note that the request payload has an order number that can only be used once)

3 - send the payload and the signed hash to browser

4 - send the payload and the signed hash from borwser to serverFirebase

5 - in serverFirebase decrypt the signed hash using the public key and compare it to the hash of the payload and check that the order number hasn't been used before

my question is that is this method secure enough? and if there are any protocols to handle this situation already.

thanks

server signing communication encryption networking
1 Answers

I think that depends on your threat model and who you expect your attackers to be and what you are assuming about the environment.

Without making this too complicated, one avenue of attack that comes to mind is man-in-the-middle between the browser and the serverFirebase. An attacker can potentially just read the messages you're generating on serverA and store it. Since he can read your messages (you're only signing the digest and leaving the payload itself unencrypted), he knows what they say and send the messages he wants, in an ordering that he wants, and whenever he wants.

If for example, your first message is buy 200 shares of Penny Stock and your next message is sell 100 shares of Penny Stock. The attacker can potentially only relay the first message and not the second.

user_118436430
Related