Is it safe to use http proxy_pass in such a scheme?

Question

Nginx

There are 3 NodeJS applications on the server: public, admin, api. Nginx is configured as a reverse proxy so the workflow looks like this:

picture

The /etc/nginx/sites-available/default file configuration looks like this

config

server {
  listen 80 default_server;
  listen[::]: 80 default_server;
  server_name _;
  return 301 https://$host$request_uri;
}

server {
  listen 443;
  server_name example.com;
  ssl on;
  ssl_certificate / home / example.com / ssl - bundle.crt;
  ssl_certificate_key / home / example.com / private - key.key;
  ssl_prefer_server_ciphers on;
  root /var/www/html;
  index index.html index.htm index.nginx - debian.html;

  location / {
    proxy_pass http://localhost:4444;
      proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }

  location / api {
    proxy_pass http://localhost:5555;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }

  location / admin {
    proxy_pass http://localhost:7777;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }
}

In general, it seems like ssl is used on the admin panel and on the public site, at least it is written in the browser. But is it really so and whether there will be pitfalls here - I don’t understand

Answer 1

Actually, what are the pitfalls? For the outside world, there is no difference, and there are no distinctions between public, admin and even api, except for authentication if you have it implied. And all requests go through a secure protocol