deployment/security

21 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Security HTTPS provided by external TLS Termination Proxy

HTTPS is normally provided by a component external to the application server, called a TLS Termination Proxy. There must be something in charge of renewing the HTTPS certificates, which could be the same component or something different.

Tools for TLS Termination Proxy with automatic certificate renewal

Traefik and Caddy automatically handle certificate renewals. Nginx and HAProxy require an external component like Certbot for certificate renewals. Kubernetes with an Ingress Controller like Nginx requires an external component like cert-manager for certificate renewals. Cloud providers may handle HTTPS internally as part of their services.

HTTPS requires certificates acquired from third party

For HTTPS, the server needs to have certificates that are acquired from a third party, not generated locally. Certificates have a lifetime and expire, requiring renewal and reacquisition from the third party.

Encryption happens at TCP level, before HTTP

The encryption of the connection happens at the TCP level, which is one layer below HTTP. Certificate and encryption handling happens before HTTP communication begins.

TCP does not know about domains, only IP addresses

TCP only understands IP addresses, not domain names. Information about the specific domain is sent in the HTTP data, which arrives after the TCP/TLS connection is established.

SNI extension allows multiple HTTPS certificates on one IP address

The SNI (Server Name Indication) extension to the TLS protocol allows a single server with one IP address to have multiple HTTPS certificates and serve multiple HTTPS domains/applications. A single component running on the server listening on the public IP must have all the HTTPS certificates.

TLS Termination Proxy handles HTTPS and manages certificates

A TLS Termination Proxy is a program that runs on the server managing all HTTPS parts: receiving encrypted HTTPS requests, sending decrypted HTTP requests to the actual HTTP application, taking the HTTP response from the application, encrypting it with the appropriate HTTPS certificate, and sending it back using HTTPS. It listens on the public IP address on port 443.

Common TLS Termination Proxy options

Options for using as a TLS Termination Proxy include Traefik (can handle certificate renewals), Caddy (can handle certificate renewals), Nginx, and HAProxy.

Let's Encrypt provides free HTTPS certificates

Let's Encrypt is a project from the Linux Foundation that provides HTTPS certificates for free in an automated way. These certificates use standard cryptographic security and are short-lived (about 3 months), which improves security due to their reduced lifespan. Domain verification and certificate generation happen automatically, and certificate renewals can be automated.

HTTPS is HTTP over encrypted TLS connection

HTTPS is plain HTTP inside a secure TLS connection instead of a pure unencrypted TCP connection. After the TLS handshake completes, the client and server have an encrypted TCP connection and can begin HTTP communication.

TLS Termination Proxy decrypts requests and encrypts responses

The TLS Termination Proxy receives encrypted HTTPS requests, decrypts them using the agreed cryptography, and transmits plain unencrypted HTTP requests to the application. It receives plain HTTP responses from the application and encrypts them using the agreed cryptography before sending them back to the client.

Multiple applications can run behind one TLS Termination Proxy

Multiple applications can run on the same server behind a single TLS Termination Proxy. Only one process can handle the specific IP and port combination, but other applications can run on the server as long as they use different port combinations. The TLS Termination Proxy can handle HTTPS and certificates for multiple domains and route requests to the appropriate application.

Certificate renewal requires proving domain ownership

To renew certificates, the renewal program must prove to the certificate authority (Let's Encrypt) that it owns and controls the domain. This can be done by modifying DNS records or by running as a server on the public IP address associated with the domain. Having the TLS Termination Proxy handle certificate renewal is useful because only one process can listen on a specific IP and port at a time.

Proxy forwarded headers for HTTPS

When using a TLS Termination Proxy to handle HTTPS, the proxy sets HTTP headers on requests before transmitting them to the application server. The forwarded headers are X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host. These inform the application server that the request is forwarded by a proxy.

Configure application server to trust forwarded headers

By default, the application server does not trust forwarded headers from a proxy. When using FastAPI CLI, you can use the --forwarded-allow-ips option to specify which IP addresses the application server should trust for forwarded headers. Setting --forwarded-allow-ips="*" makes it trust all incoming IPs if the application only receives communication from a trusted proxy.

DNS A record points domain to server IP address

A domain name is acquired and configured in a DNS server with an A record that points the domain to the fixed public IP address of the server. This is typically configured once during initial setup.

Browser resolves domain via DNS before HTTPS connection

The browser first checks with DNS servers to find the IP address for the domain. The DNS servers respond with the public IP address of the server, which the browser then uses to establish the HTTPS connection.

HTTPS uses port 443 by default

HTTPS communication uses port 443 by default. The TLS Termination Proxy listens on this port to handle incoming HTTPS connections.

TLS Termination Proxy uses SNI to select certificate

The TLS Termination Proxy uses the SNI extension during the TLS handshake to determine which TLS certificate to use based on the domain expected by the client. This allows it to serve multiple HTTPS domains from a single process on a single IP address and port.

Client verifies TLS certificate validity

During the TLS handshake, the client verifies that the TLS certificate is valid by checking it against trusted certificate authorities (such as Let's Encrypt). If the client already trusts the entity that generated the certificate, it can verify the certificate.

TLS Termination Proxy handles certificate for all applications

When an application server does not directly handle HTTPS, the TLS Termination Proxy manages all HTTPS parts for it. This separation of concerns allows the application server to communicate only with plain HTTP while the proxy handles encryption, decryption, and certificate management.

Give your agent this brain