Let's say there is an application server that runs multiple web applications. Some of these applications are accessible directly from the Internet, however a specific application requires single-sign-on, which is implemented via a reverse proxy solution that adds the proper HTTP headers. This reverse proxy implementation is running on a different box inside the company network. What are the typical ways to enforce that this particular application only processes request that are "through the SSO" (through the reverse proxy), but not the ones coming directly from the internet?
Some ideas:
- Simply check the request IP and see if that matches the proxy's
- Require an SSL client sertificate to be sent by the reverse proxy
- Do not care about the source of the incoming HTTP request, but check with the SSO if the HTTP headers included are for a valid SSO session or not
What are the pros and cons of each approach? How did you implement something similar? The particular SSO implementation is IBM WebSeal, but I'm also interested in how you've solved the problem with any other product as well. thanks!