Chapter 2. Creating Proxies for CORS

A proxy generally acts as an agent or an intermediary for a client that requests for a resource from a server. In this chapter, we will learn about the following:

• What is a proxy server?

• Reasons to use a proxy server

• Types of proxy server: forward and reverse proxies

• Reverse proxy in node.js with CORS anywhere

Proxies and the World Wide Web

Generally speaking, a proxy is someone or something that has the authority to represent some other person or thing; for example, a proxy may be authorized to vote on behalf of another person.

The World Wide Web is composed of individual machines communicating with each other. A web proxy acts as an intermediary with the authority to communicate with a third-party server on behalf of a server contacting the proxy server. Modern web applications are often distributed across many servers, and proxies can tie them together.

What is a proxy server?

A proxy server handles requests from clients asking for resources from another server. The requests may be for resources, such as files, web pages, or other resources from different servers. If the request is validated, the proxy server retrieves the resource and sends it to the requesting client. There are many types of proxy; they share the common purpose of acting as intermediaries to facilitate requests between clients and target servers.

Note

Proxy servers are defined by the Internet Engineering Task Force (IETF) at

.

Proxy server connections are specified by the W3C at

.

People who work for large organizations are probably familiar with the process of configuring their web browser, or other desktop applications that require Internet access to connect through a proxy. The proxy provides them with access to the Internet, while the network firewall protects the devices inside their network from intrusions.

Note

A proxy server may eliminate the need for CORS in your application...

Reasons to use a proxy

There are several reasons why you should place a proxy between your local domain and the target domain, which are as follows:

Avoid mixing up protocols

If your local domain application is served over SSL with HTTPS and you request a resource that is not served via SSL, the user may get a warning in the browser about mixing secure and non-secure content. Since the request to a proxy can also be made over SSL, there is no mixed content and the user sees no warning.

Some API platforms require proxies or CORS

An API hosted on a domain different from the local domain, a cloud-hosted API, or an Enterprise Service Bus (ESB) may require that cross-domain requests pass through a proxy or be handled by CORS. Apigee Edge, Mulesoft, and Google App Engine are platforms that require a proxy, or CORS, to pass requests. We will review solutions for specific platforms and applications in later chapters.

Getting through a local network firewall

In the same way that you may have to set up...

Creating a proxy server with Google App Engine

Google App Engine is an easy way to set up a proxy server for testing code and learning how to use a proxy.

Tip

If you use a public proxy server such as Google App Engine, then your data will not be private. A public proxy is suitable for testing, but you will need to use a secure proxy server that you own for production applications.

Create a New Application with Google App Engine:

There are detailed instructions at , including how to add authentication, because the proxy server will be publicly accessible. Even with added authentication, this proxy server is not sufficiently secure for a production application!

Reverse proxy server

A simple proxy server is known as a forward proxy, which retrieves a resource from another server and sends it to the original client making the request.

A reverse proxy server also retrieves resources on behalf of a client and returns them to the client as if they come from the proxy server itself, not from their actual...

Summary

Short and sweet, isn't it? We learned about proxy servers handling requests from our applications and forwarding the resource back to our application. We also saw scenarios such as avoiding mixing protocols, getting through local network firewalls, and API platforms that require proxies.

We also learned about forward proxy and reverse proxy. We walkedthrough the code that creates a reverse proxy server in Apache. Then we learned about using CORS anywhere to create a reverse proxy in node.js.

In the next chapter, we will learn about usability and security. We will learn ways to make sure that CORS can be used, including preflight. We saw that CORS itself does not provide much security, so we will look at how to secure your CORS application.