http-proxy-middleware | liner node.js http-proxy middleware | Runtime Evironment library

I didn't need vhost nor http-proxy-middleware. i used http-proxy and some vanilla javascript.

I was struggling with the same problem when adding a controller to the Visual Studio 2022 "out-of-the-box" .NET Core React SPA template. What I did to get it to work was to find the file setupProxy.js, which in the current template is here: ClientApp\src\setupProxy.js. In this file I added the route to the new controller:

My senior colleague helped me to fix this. It seemed that the request, http://localhost:3000/products-and-details/api/v1/proxy/trend/api/v1/listProducts was not at all intercepted by the proxy. Hence, to intercept those requests we have to make sure to include it in the context for our proxy middleware.

So, in my case it was as described below:

Use of a reverse proxy should be 100% transparent to clients and your application code, with zero code changes. So perhaps it is a design problem where I can clarify requirements for you.

URL DESIGN

As an API example, I might design URLs as follows for an API:

• Public URL: https://api.mycompany.com/products
• Internal URL: https://productservice.internal.com:3000

Note that the public URL of the API is actually that of a route within the reverse proxy.

An internet client would only ever use the public URL. If the internal API ever returns URLs to internet clients, it needs to be configured to use the public URL.

REVERSE PROXIES

The most mature options are probably the nginx based ones, which provide both declarative routing and also the ability to write any logic you like via plugins. There are plenty of examples in Curity guides, which may make you aware of some use cases

A mainstream option is to use the proxy-pass directive to route to an internal URL. The same pattern should work for the node RP you mention, though for simple tasks no custom logic should be needed.

Header configuration is a common thing to do in the RP, eg to ensure that the component receives the original client's IP address, rather than that of the RP, but that is often optional.

MISBEHAVING BACKEND COMPONENT

Perhaps this is the root of the problem - if a website returns the internal URL, eg in redirects or image URLs, then it is wrong. Many tech stacks will have a property such as BaseUrl that fixes this.

rewrites are a convenient way of proxying requests without having to setup your own logic in a server - Next.js handles it for you instead.

Just like http-proxy-middleware, they allow you to map an incoming request path to a different destination. The main difference is that rewrites are also applied to client-side routing, when using Next.js' built-in router (through next/link or next/router) to navigate between pages.

From the rewrites documentation:

Rewrites act as a URL proxy and mask the destination path, making it appear the user hasn't changed their location on the site.

(...) Rewrites are applied to client-side routing, a will have the rewrite applied in the above example.

A common pattern is to prefix all your proxied URLs with /api or similar.

For example

Turns out the problem was that the BodyParser middleware was parsing the request body which "consumes" the underlying data stream. Then when my proxy code runs, it tries to proxy the fall and the request body with it, but is unable to do so as the data stream has been consumed. The proxied server waits indefinitely for the request data but it never arrives.

My solution was to write my own middleware that wraps both body parser and the proxy middleware. I decide which to use based on the request url - if URL starts with /game-server/ or ends with /game-server, use proxy, else use body parser.

For completeness, here is the code:

Bootstrapping:

I had the same problem with literally the exact same number of vulnerabilities.

Check out the solution here

Found the solution on GitHub issue:

You need to use IP address for proxy to work: