Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
12 changes: 12 additions & 0 deletions modules/admin/pages/deployment/services/s-list/proxy.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,9 @@ See the https://content-security-policy.com[Content Security Policy (CSP) Quick
Infinite Scale cannot always determine whether the entire communication chain between itself and the client is secure. Consider the following scenarios:

.Client - Webserver - Infinite Scale (incomplete)
image:deployment/services/proxy/proxy-client-webserver-ocis-incomplete.png[]

////
[ditaa]
----
+----------+ +------------+ +-----------+
Expand All @@ -320,8 +323,12 @@ Infinite Scale cannot always determine whether the entire communication chain be
| |
Termination Unsecured
----
////

.Client - Webserver - Infinite Scale (complete)
image:deployment/services/proxy/proxy-client-webserver-ocis-complete.png[]

////
[ditaa]
----
+----------+ +------------+ +-----------+
Expand All @@ -334,8 +341,12 @@ Infinite Scale cannot always determine whether the entire communication chain be
| |
Termination Secured
----
////

.Client - Loadbalancer - Webserver - Infinite Scale (incomplete)
image:deployment/services/proxy/proxy-client-loadbalancer-ocis-incomplete.png[]

////
[ditaa]
----
+----------+ +--------------+ +------------+ +-----------+
Expand All @@ -348,6 +359,7 @@ Infinite Scale cannot always determine whether the entire communication chain be
| | |
Termination Unsecured Unsecured
----
////

As you can see in Figure 2, the entire chain is secured by HTTPS, and the headers will be sent accordingly. The other figures illustrate that, although the client has a secure connection, the subsequent connection is insecure. Because the Infinite Scale proxy service can only detect his connection, it sends back headers for an insecure connection.

Expand Down