title: Providing internet access to my self hosted web api on an internal network. A security threat?
body: <p>Firstly, I'm relatively new to Web API / CORS and security implementation.</p>
  
  <p>This question is specifically with regards to security. The Web API houses extremely sensitive data and provides clients with the ability to execute transactions online.</p>
  
  <p>The context :</p>
  
  <ul>
  <li>I have a Web API self hosted as a windows service with a fixed port.</li>
  <li>The Web API is sitting behind a firewall / DMZ on an internal network.</li>
  <li>The Web API (using CORS) only allows traffic from the external server.</li>
  <li>The external server hosts our web site using IIS.</li>
  <li>The Web API is making use of Token authentication (bound to client IP to avoid hi-jacking).</li>
  <li>Both the external website and internal Web API force the use of SSL.</li>
  </ul>
  
  <p>The problem :</p>
  
  <p>The web page makes ajax calls via javascript to the Web API. However, the Web API is not directly exposed to the internet.</p>
  
  <ul>
  <li>What would the security impact be on having the below setup?</li>
  <li>What sort of vulnerabilities would I be exposing my network too by doing so.</li>
  <li>Is there a better way of implementing such a setup!?</li>
  </ul>
  
  <p>Eg</p>
  
  <ul>
  <li><p>User enters <code>https://test.mydomain.com</code> into the browser and is served a page.</p></li>
  <li><p>ajax call gets made to <code>https://test.mydomain.com/api/test/action</code></p></li>
  <li><p>external server routes <code>https://test.mydomain.com/api</code> messages to internal server <code>https://myInternalWebAPI/api/test/action</code> which is not exposed to the public.</p></li>
  </ul>