Is it okay to pass secrets through the headers of a reverse proxy?

Wim ten Brink

4/11/24, 9:58 AM

So, I've set up a reverse proxy for multiple domains in nginx like this:

server {
    listen 80;
    listen [::]:80;
    root /var/www/nginx;
    index index.html index.htm;
    server_name example.com example.org example.net example.nl;
    location / {
        proxy_pass http://localhost:7001/;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        proxy_set_header Accept-Encoding gzip;
    }
}

And it sets a few headers for this purpose. The process on localhost:7001 is a .NET 7 application using Kestrel and right now it gets settings from a local JSON file. Some of these settings are API keys for remote services that need to stay secret.
I now wonder if it's okay to pass these secrets as headers in this nginx configuration and have the application read them from the headers. Something like proxy_set_header ApiKey <My-Key>; so the application doesn't need to use the key from the configuration.
Maybe I would need to encrypt it in here too. It would be no problem to include RSA encryption over this key, with the private key in the application and a console application that can generate this key using the public key.
But I wonder if this is a good practice. It looks secure to me because if someone has access to the nginx configuration then my server is already breached. But am I missing a security risk here? Because this needs to be as secure as possoble...

0 + 1

nginx

nginx-reverse-proxy

secrets

.net-7

HBruijn

4/11/24, 3:13 PM

In general HTTP headers can and will (also) be set by the user/client and are not only set by your reverse proxy. So like any other user input header values can't be considered trusted nor should they be used elsewhere in your application without prior sanitisation and validation. When using values from a configuration file you normally can consider them trusted and you wouldn't need to employ similar sanitisation and validation. - In my opinion reading an API key from a configuration file would reduce the complexity in your code.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is it okay to pass secrets through the headers of a reverse proxy?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.