4

Given a system of services and a reverse proxy, such that requests may either be conclusively processed by the proxy or ultimately handled by any of the services behind the proxy.

Consideration has be given to the X-Forwarded-For, Forwarded, X-Forwarded-Host fields. Though they appear naturally fitting for the request phase, would it be confusing to use them in the response phase?

What header field is conventionally used to declare the host that primarily provided an HTTP response?

-- The motivation for including information on proxied servers is to ease debugging and application support process.

-- I don't believe an attacker benefits specially from learning that a service makes use of a reversed proxy. Proxied servers can be identified with aliases which cannot lead to direct access to them. In the image below, the proxied server has the alias 03.

enter image description here

A different implementation could use an alias as follows: X-Backend-Server: mickymouse. That's a pointless piece of information for anyone but it's author.

Improve this question
3
  • Can you provide some details on why this behavior would be desirable? As Dan Wilson mentions in his answer, this is something that while not directly insecure, provides details to the clients that they shouldn't need.
    – JimmyJames
    Oct 9, 2018 at 13:54
  • It would ease debugging and application support process.
    – Igwe Kalu
    Oct 10, 2018 at 7:48
  • In that case, you probably don't need to follow any standard. I would suggest looking into log aggregation, though. It will help you with this and a lot more without exposing details about your architecture in headers.
    – JimmyJames
    Oct 10, 2018 at 13:31

2 Answers 2

Reset to default
2
+50

I think what you want is Via header. From the RFC,

The "Via" header field indicates the presence of intermediate protocols and recipients between the user agent and the server (on requests) or between the origin server and the client (on responses), similar to the "Received" header field in email

Regarding security concerns, you should use pseudonyms for internal servers. From the RFC:

An intermediary used as a portal through a network firewall SHOULD NOT forward the names and ports of hosts within the firewall region unless it is explicitly enabled to do so. If not enabled, such an intermediary SHOULD replace each received-by host of any host behind the firewall by an appropriate pseudonym for that host.

Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing

Improve this answer
2

What header field is conventionally used to declare the host that primarily provided an HTTP response?

None

A reverse proxy serves resources on behalf of some other server. Revealing any details about the origin server is almost universally unwanted behavior, and could be a potential security risk.

It would be confusing to use X-Forwarded-For, Forwarded, and X-Forwarded-Host headers since these are used with forward proxies.

If you want to identify the origin server handling a request for debugging purposes then you are free to use whatever header you like. A better option might be to set a cookie, similar to a session cookie inserted by load balancers, that you can disable when no longer needed.

Finding an authoritative source is difficult since there is no official standard for this, but I offer the following.

By intercepting requests headed for your backend servers, a reverse proxy server protects their identities and acts as an additional defense against security attacks.

Improve this answer
5
  • Kindly see my updated question. Reverse proxies are common in application architecture these days. Any attacker worth her/his salt should know this already. And any suggestion of using a reverse proxy would not necessarily make an attack easier.
    – Igwe Kalu
    Oct 10, 2018 at 7:50
  • 2
    @IgweKalu It won't 'necessarily' make an attack easier but because of the asymmetry of security (they need to find a flaw or two - you fix them all) it's good practice to aggressively cut out any information or features that aren't strictly necessary for normal use. Returning stack traces in error responses, for example, can be useful for debugging and support but doing so is well known to increase the risk of successful compromise.
    – JimmyJames
    Oct 10, 2018 at 13:36
  • @IgweKalu Fingerprinting servers is a useful tool in penetrating a network. When I see X-Backend-Server: 03 I assume 1) that you are using a proxy and 2) that you have at least three servers behind your proxy. That may not help enable an attack by itself, but it's one more piece of the puzzle as I map out your network. Information leakage is a real threat.
    – Dan Wilson
    Oct 10, 2018 at 13:57
  • A different implementation could use an alias as follows: X-Backend-Server: mickemouse That said, the benefits are worth more than the perceived risk.
    – Igwe Kalu
    Oct 10, 2018 at 14:16
  • You can return a signed uuid per request per server. Each server has its own secret (e.g. server name). This way you can determine which server sent the response without revealing the server to the client.
    – chromanoid
    Oct 11, 2018 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.