te')); return $arr; } /* 遍历用户所有主题 * @param $uid 用户ID * @param int $page 页数 * @param int $pagesize 每页记录条数 * @param bool $desc 排序方式 TRUE降序 FALSE升序 * @param string $key 返回的数组用那一列的值作为 key * @param array $col 查询哪些列 */ function thread_tid_find_by_uid($uid, $page = 1, $pagesize = 1000, $desc = TRUE, $key = 'tid', $col = array()) { if (empty($uid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('uid' => $uid), array('tid' => $orderby), $page, $pagesize, $key, $col); return $arr; } // 遍历栏目下tid 支持数组 $fid = array(1,2,3) function thread_tid_find_by_fid($fid, $page = 1, $pagesize = 1000, $desc = TRUE) { if (empty($fid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('fid' => $fid), array('tid' => $orderby), $page, $pagesize, 'tid', array('tid', 'verify_date')); return $arr; } function thread_tid_delete($tid) { if (empty($tid)) return FALSE; $r = thread_tid__delete(array('tid' => $tid)); return $r; } function thread_tid_count() { $n = thread_tid__count(); return $n; } // 统计用户主题数 大数量下严谨使用非主键统计 function thread_uid_count($uid) { $n = thread_tid__count(array('uid' => $uid)); return $n; } // 统计栏目主题数 大数量下严谨使用非主键统计 function thread_fid_count($fid) { $n = thread_tid__count(array('fid' => $fid)); return $n; } ?>Security considerations when using Apache with SSL enabled and Node.JS without SSL - Stack Overflow

科技改变生活-雨落星辰 - 所有的伟大,都源于一个勇敢的开始

    最新消息：雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客
    你的位置： 首页>programmer>Security considerations when using Apache with SSL enabled and Node.JS without SSL - Stack Overflow

    Security considerations when using Apache with SSL enabled and Node.JS without SSL - Stack Overflow

    programmeradmin4浏览0评论

    So I have a peculiar setup to work with. The main server is your standard off-the-mill Apache server with SSL enabled bound to a public domain (NOT localhost!). My Node.JS server runs on localhost:8080. They both run on the same machine so there are no network security considerations.

    I have successfully setup a ProxyPass and VirtualHost for port 8080.

    httpd.conf:

    SSLProxyEngine on
ProxyPass /mycustompath http://localhost:8080

    http-vhosts.conf:

    <VirtualHost *:8080>
    ServerName example
    ServerAlias *.example
    SSLProxyEngine on
    SSLProxyVerify none 
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    ProxyPreserveHost On
    ProxyPass /mycustompath http://localhost:8080
    ProxyPassReverse /mycustompath http://localhost8080
    SSLCertificateFile "mypathto/server.crt"
    SSLCertificateKeyFile "mypathto/server.key"
</VirtualHost>

    The URL points internally to the http://localhost:8080. Using Postman I was able to confirm that the entire setup works properly.

    However, I am unsure if this is safe and if SSL is used properly. Does Apache handle the SSL and the forward the decrypted request or is the connecting client fully redirected to the Node.JS server on localhost? Right now I am not using HTTPS in my Node.JS server code. Do I need to?

    Additional note: I have tried without the SSLProxyVerify portion in http-vhosts.conf, but then I get an SSL handshake error. I assume the Apache server is expecting the Node.JS server to have SSL enabled in this case.

    So I have a peculiar setup to work with. The main server is your standard off-the-mill Apache server with SSL enabled bound to a public domain (NOT localhost!). My Node.JS server runs on localhost:8080. They both run on the same machine so there are no network security considerations.

    I have successfully setup a ProxyPass and VirtualHost for port 8080.

    httpd.conf:

    SSLProxyEngine on
ProxyPass /mycustompath http://localhost:8080

    http-vhosts.conf:

    <VirtualHost *:8080>
    ServerName example
    ServerAlias *.example
    SSLProxyEngine on
    SSLProxyVerify none 
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    ProxyPreserveHost On
    ProxyPass /mycustompath http://localhost:8080
    ProxyPassReverse /mycustompath http://localhost8080
    SSLCertificateFile "mypathto/server.crt"
    SSLCertificateKeyFile "mypathto/server.key"
</VirtualHost>

    The URL https://example/mycustompath points internally to the http://localhost:8080. Using Postman I was able to confirm that the entire setup works properly.

    However, I am unsure if this is safe and if SSL is used properly. Does Apache handle the SSL and the forward the decrypted request or is the connecting client fully redirected to the Node.JS server on localhost? Right now I am not using HTTPS in my Node.JS server code. Do I need to?

    Additional note: I have tried without the SSLProxyVerify portion in http-vhosts.conf, but then I get an SSL handshake error. I assume the Apache server is expecting the Node.JS server to have SSL enabled in this case.

    • node.js
    • apache
    • ssl
    • proxy
    • proxypass
    Share Improve this question asked 2 days ago bblizzardbblizzard 7285 silver badges8 bronze badges 2
    • 1 This question might be more suited for security.stackexchange – Mureinik Commented 2 days ago
    • 1 Thanks! I'll do that. In case anybody stumbles upon my question here, this is the new URL: security.stackexchange/questions/280612/… – bblizzard Commented yesterday
    Add a comment  | 

    1 Answer 1

    Reset to default 0

    As you guessed correctly, the traffic from Apache to your NodeJS applications is being sent unencrypted.

    ProxyPass /mycustompath http://localhost:8080

    So anyone having access to your VM could look into said traffic - which might OTOH then be your smallest issue :)

    And yes, there are documents out there that explain to set up TLS certificates for use in Node.

    与本文相关的文章

    发布评论

    评论列表(0)

    1. 暂无评论