Jump to content

Php On A Seperate Business Logic Server From Web Serve...how?


bluesclues9

Recommended Posts

Hi

I am lost here. We need to deploy our first CakePHP application using 3-tier architecture as follows. My CakePHP appl. already works on my localhost however, we need to place CakePHP appl. inside firewall and have a separate webserver outside firewall that actually processes user requests.

 

How can we deploy something like this?. This is needed to protect all code written in CakePHP (Controllers, Models, Views). The desired deployment is like this..

 

1. Web Server - Just receives requests/sends responses back to the user. This is outside firewall.

 

2. App Server - This is where we have CakePHP code. Receives Requests 'Only' from webserver and processes requests using CakePHP M-V-C and responds to WebServer.

 

3. Database Server - This is where we have Database engine running. This server receives requests from AppServer. CakePHP AppServer simply connects to this Database Server.

 

As of now, my localhost has Web/AppServer running. I don't like this architecture as my localhost has CakePHP code developed by us.

 

Any ideas...I thought this is no brainer but now, I am perplexed as how I can split WebServer and AppServer(CakePHP).

 

Thanks

Blues Clues

Link to comment
Share on other sites

Web Server tier is simply for hiding my CakePHP codebase behind a firewall...CakePHP tier (so called app server in my architecture above, #2) has a lot of business logic code writtenw which if hacked would be a disaster. So we need to keep this behind a powerful firewall and allow only our front-end webserver make requests through a specific port (say, 7000). period.

In this way, we can be fairly confident that the codebase is secured.

 

I am really puzzled about this whole M-V-C framework not providing ways to seperate business logic tier onto a seperate server. I can't imagine noone has ever needed this security (that I am looking for right now). Am I missing something?. None of M-V-C frameworks (PHP) offer this seperation.

Link to comment
Share on other sites

What I'm saying is:  What purpose does this entire server serve if it does nothing but forward all requests to a second server?  if I try to hack your server, this "proxy" will just forward my hack attempts along.

 

You've never seen this before because the thing you're trying to do doesn't make any sense.

 

I've worked with systems where business and display logic were on separate servers.  They used an internal API.  But your system is already designed, and you have just now thought about this problem.  It's too late to separate your logic into different servers.

Link to comment
Share on other sites

I built an application using drupal7 and I want to separate the app server (for database access, dynamic processing of PHP scripts) from Apache web service. Is it possible? came to know that In CakePHP like frameworks it is possible by modifying the app server configuration and expecting a solution in case of Drupal also soon, please.

Link to comment
Share on other sites

  • 4 weeks later...

What it sounded like the OP was looking for was to have the first server receive requests then process those requests and send new requests based on those requests through the firewall on a particular port. Once the intermediate server receives the response from the second server it packages it up all nice and pretty and returns it to the user. It seemed like just a plain proxy was not their intention.

 

Now for the problem. Even if server #1 doesn't just forward all requests straight to server #2 (which would be done with port forwarding on the router), if server #1 gets 'hacked' it is a trivial thing to use it as a proxy to attack the second server and to know which ports are open. Server #2 would think all the requests were coming from server #1 since we would be accessing it via server #1, so attempts to restrict access to only that one machine would be futile.

 

It is a convoluted plan for security that doesn't provide any real security at all.

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.