Front cover - IBM Redbooks

Do not “over cache” when using a caching proxy
From a security best practices point of view, the single most relevant thing you
want to ensure is that the a caching proxy caches what is cacheable and does
not cache what is not cacheable. The results of ignoring no-cache directives by
proxy servers configured as “bandwidth-savers” can range from authentication
problems, to SSO not working as expected, to key pieces of functionality such as
Sametime awareness not functioning.
Lotus products actively rely on proxies not over-caching non-cacheable content,
otherwise results are truly unpredictable.
Troubleshooting tip: When debugging a connection between two entities,
say Alice and Bob, if you have even the remote suspicion that somebody (your
friendly network people or even your ISP) could have configured a transparent
proxy in the middle between Alice and Bob, then look for this clue: additional
response headers that include “via.”
In many field cases, we have found (protocol analyzer in hand) that some of
those transparent forward proxies over-cache or aggressively cache content,
which means that they are configured to save bandwidth, no matter what.
Thus, they behave as if “they know better” or “are smarter proxies,” in effect
ignoring the “no-cache” and “expires” directives that the Web server may have
imposed on the content.
Your security policies should specify that network administrators should never
over-cache contents. Most administrators will understand and agree to a
sensible policy since security must not be compromised to achieve better
network performance.
Track client IP addresses
By default, many reverse proxy servers will hide the client’s original IP address
when making requests to back-end servers. Thus, all requests will appear to
come from the same IP address. Privacy settings of many proxy products allow
additional HTTP headers to be passed along with the requests. Thus, one can
enable the forwarding of the client’s IP address to a destination server. This adds
an additional HTTP header value containing the requesting client’s actual IP
address. Which is of great security value since it enables you to track and
troubleshoot any client connections.
Turn off DNS lookups
Many proxy servers allow for DNS lookups of connecting clients. This option
causes the proxy server to resolve each incoming client’s IP address with a host
Chapter 5. Proxies 185