4 ms·

You could proxy the request through a back-end server that does support HTTPS.

by Twisol 16y ago

JonnieCache 16y ago
Could I write a tiny one in rack and mount that in front of the rails stack using the new router in ActionDispatch 3? Hmmm...
- Twisol 16y ago
  Hmm, probably. Doesn't sound like a bad idea. Still, if the proxied request takes a long time, you might be locking out other requests from hitting the real app.
  - JonnieCache 16y ago
    Would I be right in thinking that if I was serving my app using an evented web server (nginx) this would not be such a problem? Or would it still be tying up a passenger instance anyway? If my request hits the router and then goes straight to a seperate rack app, does this still require a full weight passenger process and one copy of my full app stack in memory (albeit shared memory?)
patio11 16y ago
A word of caution: it is very easy for naive attempts to do this to end up creating an open proxy. You don't want that.
- deleted 16y ago
  [deleted]
- tptacek 16y ago
  You profoundly don't want that.
  - patio11 16y ago
    Thank you, your comment reminded me of why this is Severity: Critical. Here's where Thomas and I live in different worlds: I hear "open proxy" and I think "a malicious user can use your server to attack other services on the Internet or download kiddie porn.". Thomas hears "open proxy" and starts to see visions of a host possibly within the firewall which can be used to make arbitrary HTTP requests against servers within the firewall, which let's you target the weak underbellies of e.g. intranet applications which have no security because all users are presumed to be employees and where compromise can do interesting things like e.g. read out all your source code through Trac, initiate wire transfers through the accounts payable application, etc. Yeah, you profoundly do not want open proxies.
    - tptacek 16y ago
      Sev: biblical. You're coughing up the lights-out management consoles on servers and storage appliances with them. I'm sure there's all sorts of funny business to be perpetrated through them with admin and account management applications. But I wouldn't know, because you're usually 5 minutes from command execution on the server once you find one.

You could proxy the request through a back-end server that does support HTTPS.

by Twisol 16y ago

You could proxy the request through a back-end server that does support HTTPS.

Could I write a tiny one in rack and mount that in front of the rails stack using the new router in ActionDispatch 3? Hmmm...

Twisol 16y ago
Hmm, probably. Doesn't sound like a bad idea. Still, if the proxied request takes a long time, you might be locking out other requests from hitting the real app.
- JonnieCache 16y ago
  Would I be right in thinking that if I was serving my app using an evented web server (nginx) this would not be such a problem? Or would it still be tying up a passenger instance anyway? If my request hits the router and then goes straight to a seperate rack app, does this still require a full weight passenger process and one copy of my full app stack in memory (albeit shared memory?)

patio11 16y ago

A word of caution: it is very easy for naive attempts to do this to end up creating an open proxy. You don't want that.

deleted 16y ago
[deleted]
tptacek 16y ago
You profoundly don't want that.
- patio11 16y ago
  Thank you, your comment reminded me of why this is Severity: Critical. Here's where Thomas and I live in different worlds: I hear "open proxy" and I think "a malicious user can use your server to attack other services on the Internet or download kiddie porn.". Thomas hears "open proxy" and starts to see visions of a host possibly within the firewall which can be used to make arbitrary HTTP requests against servers within the firewall, which let's you target the weak underbellies of e.g. intranet applications which have no security because all users are presumed to be employees and where compromise can do interesting things like e.g. read out all your source code through Trac, initiate wire transfers through the accounts payable application, etc. Yeah, you profoundly do not want open proxies.
  - tptacek 16y ago
    Sev: biblical. You're coughing up the lights-out management consoles on servers and storage appliances with them. I'm sure there's all sorts of funny business to be perpetrated through them with admin and account management applications. But I wouldn't know, because you're usually 5 minutes from command execution on the server once you find one.