Question

https://github.com/nodejitsu/node-http-proxy”rel=“noretinger”>node-http-proxy 代理服务器,使我能够在80项港口向8000号港口的用户发送了我们的代理服务器。然而,我对为什么这是一个好的想法以及这一想法究竟如何保护人们不受安全影响感到困惑不解。

说明-实践文件讨论了如何利用这一文件向多个港口或目的地的用户提出申请。这显然非常有用,特别是采用基本的双筒负荷平衡战略。然而,我们只有一个港口,因此没有必要这样做。

如果存在一个重要的安全理由,我们为什么要利用这一代理服务人员,那么我很想知道它保护的哪些类型的攻击。此外,我们重新使用袖珍。因此,如果代理人确实帮助网络服务器升级,我也想知道这一点。我们重新调整了如何在没有<代码>sudo的情况下管理我们的仪器。既然所有低于1024年的港口都需要根本的准入,那么,如果在这一点上确实没有理由使用代理服务器,那么我们就只是将报废。如果任何人知道如何在80港使用代用服务器进行这种操作,而根本无法进入,那么这也就非常有益。感谢!

Answer 1

进行反向代理的原因是:

You have limited IP ports open and need to run many Node services each of which needs it s own port
Your back-end service does not support HTTPS but you need it (e.g. Derby)
To add some other feature to the request that cannot be easily done with the back end such as adding Basic Authentication or some form of common logging/auditing
To enforce an addition or change to outgoing responses common across several back end services
To provide a load-balancing service

除非你的需求非常简单,否则最好使用专用代理,如 HAproxy,因为Node-http://proxy is rather simplistic。

Answer 2

Well, if you re only running one instance of server, then theres not really a reason. The node-http-proxy docs mention using a single SSL certificate across multiple apps, which is very possible. You can also load balance across several HTTP and web socket servers (say, run 10 socket.io servers for real time data but only 1 HTTP server to serve out assets and REST APIs). Of course with one instance these don t provide any benefits.

If you want to run node servers without sudo, maybe you could try setting up IP tables port forwarding from port 80 to a port above 1024. See Can I run Node.JS with low privileges?

Answer 3

我们主要利用网上浏览器,在单一IP背后拥有多个后端服务器,但我们也利用该服务器向https传送。它加强了我们的期望。

Security wise, you may have more confidence on the good quality of http-proxy than on your app. The proxy build by nodejitsu is ready for production and it should be harder for attaquants to gain privileges (like reading the private key files) on a http-proxy instead of your own app (of course this depends on your security development skill and your trust in the open source http-proxy project).

友情链接