Should I always use a reverse proxy for a web app?

Question

I'm writing a web app in Go. Currently I have a layout that looks like this:

[CloudFlare] --> [Nginx] --> [Program]

Nginx does the following:

• Performs some redirects (i.e. www.domain.tld --> domain.tld)
• Adds headers such as X-Frame-Options.
• Handles static images.
• Writes access.log.

In the past I would use Nginx as it performed SSL termination and some other tasks. Since that's now handled by CloudFlare, all it does, essentially, is static images. Given that Go has a built in HTTP FileServer and CloudFlare could take over handling static images for me, I started to wonder why Nginx is in-front in the first place.

Is it considered a bad idea to put nothing in-front?

Answer 1

In your case, you can possibly get away with not running nginx, but I wouldn't recommend it.

However, as I touched on in this answer there's still a lot it can do that you'll need to "reinvent" in Go.

• Content-Security headers
• SSL (is the connection between CloudFlare and you insecure if they are terminating SSL?)
• SSL session caching & HSTS
• Client body limits and header buffers
• 5xx error pages and maintenance pages when you're restarting your Go application
• "Free" logging (unless you want to write all that in your Go app)
• gzip (again, unless you want to implement that in your Go app)

Running Go standalone makes sense if you are running an internal web service or something lightweight, or genuinely don't need the extra features of nginx. If you're building web applications then nginx is going to help abstract "web server" tasks from the application itself.

Answer 2

I wouldn't use nginx at all to be honest, some nice dude tested fast cgi go + nginx and just go standalone library. The results he came up with were quite interesting, the standalone hosting seemed to be much better in handling requests than using it behind nginx, and the final recommendation was that if you don't need specific features of nginx don't use it. full article

You could run it as standalone and if you're using partial/full ssl on your site you could use another go http server to redirect to safe https routes.