What are the mandatory requirements for a reverse-proxy (like Azure Application Gateway) sitting in front of IFS Middleware Server, to expose the application safely over the internet?

All FAQ questions / Security and access

Answer

Several requirements apply together: the proxy must be a genuine reverse-proxy, meaning it terminates the internet connection at the proxy and establishes a separate, new connection to MWS on the intranet side, rather than just passing external requests straight through; it must send the correct public/proxy URL as the Host header to the MWS webserver (e.g. proxy_set_header host $http_host), since MWS will otherwise block requests that don't carry the expected host value; it must be WebSocket-compliant, supporting the HTTP-to-WebSocket protocol upgrade, since the IEE client relies on WebSocket notifications; SNI (Server Name Indication) support should NOT be enabled on the proxy; and SSL 2.0, SSL 3.0, and TLSv1 should all be disabled as insecure protocols. Before exposing the proxy to the internet, test it with an external tool like SSL Labs' SSL Test and confirm an A+ rating — if it doesn't achieve that, the proxy configuration needs further hardening before going live.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions