0

I have a proxy server that talks to a bunch of services and I want to have a way to prove to servers behind the proxy they are actually receiving a request from the proxy server and not from something else.

I thought about letting clients register themselves dynamically with a key/secret pair thing and sign requests with this pair but there might be other solutions out there that I'm not considering.

I have full control over clients and servers but would rather not have to do this at the network but at the application layer. These apps specifically are built in go.

  • 2
    SSL. Client certificates. Wheel already invented. – Philip Kendall May 18 '17 at 16:33
  • @PhilipKendall I'd call that a square wheel. – CodesInChaos May 18 '17 at 16:37
  • I guess you might not consider it enough of an app layer solution, but kerberos has been a good answer for me. – joshp May 19 '17 at 3:39
1

There is a contradiction between the title and the body of your question. Since the title makes no real sense (a client connecting to a client?), I'll assume your question is the one from your body, emphasis mine:

I want to have a way to prove to servers behind the proxy they are actually receiving a request from the proxy server and not from something else.

If both the proxy server and the servers are a part of your network, then the app servers can simply match the IP address of the request with the IP address of the proxy server. Of course, you should be sure that you don't have a rogue DHCP on your network, and that your proxy server has a static IP address no other machine could have if the proxy is down. If you are unsure about the network configuration, ServerFault may help.

If the proxy is outside your network, but you're able to control its configuration, you may ask the server to inject the secret key in the HTTP headers of the request. Obviously, HTTPS between the proxy and the server is mandatory to prevent the leakage of the secret key.


Following the comments, it appears that, indeed, the goal is to be able to identify whether the request was sent directly or through a proxy—any proxy. I imagine that the OP wants to throw away users who are accessing the website through a proxy server (by the way, if this is the real purpose of the question, the goal is itself subject to discussion).

In this case, the technique which would work most of the time consists of checking the presence of HTTP headers which are usually added by proxy servers. It should be noted that some proxies may decide not to add any headers; similarly, nothing prevents the original requester from adding those headers without being a proxy.

Another approach would be to continuously index IP addresses of proxy servers used by the bad guys (if this is the actual problem you're trying to solve). The benefit is that legit users—the ones who are behind a corporate firewall, for example—are not affected. The drawback is that it's relatively easy for an attacker to swap a proxy server when the one he uses is blocked.

  • The downstream servers don't know all the proxy servers or their addresses and getting them to know them all is not feasible, i'm looking for an application layer solution. – Maurício Linhares May 18 '17 at 18:28
  • 3
    So you want to be sure you received a request from some machines you can't identify, and not from some other machines you can't identify either? What's your goal? – Arseni Mourzenko May 18 '17 at 18:48
  • Yes, I don't want to identify the machine, I want the system to believe it is the proxy system that's sending the request, it could be coming from anywhere, I just need something that the other side can verify, ok, this is the proxy, let me move forward. – Maurício Linhares May 18 '17 at 21:12
  • I think I understand what you're looking for. I edited my question accordingly. By the way, you may have better answers faster the next time if you actually explain your goal and your context, instead of hiding it. Especially when it's a XY problem, which seems to be exactly the case here. – Arseni Mourzenko May 18 '17 at 21:58
  • I'll note that there are third party services which sell continuously updated databases of proxy servers (and of cloud-computing hosts, which are just as bad as proxies, user identification-wise). All such services have a ton of false positives and a ton of false negatives, partly because the companies providing proxies do their best (with mixed success) to avoid being in such databases. – Brian May 19 '17 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.