Should Jetty always be behind another webserver (eg nginx, apache) to improve security?

Question

For a long time I've always run nginx in front of jetty to do load balancing. However, I have a new project where I will be using HAProxy to do the load balancing and was wondering if I should have HAProxy send connections directly to Jetty or if I should have each Jetty instance be behind nginx or another web server.

Specifically I'm wondering if there are any security advantages/disadvantages with either approach.

Should Jetty be "protected" by nginx/apache, or can I essentially expose it to the internet behind the thin proxy of of HAProxy?

Answer 1

If you're passing requests directly to Jetty from nginx unaltered, then there is no security benefit to be had.

nginx doesn't change requests in any way that would protect the Jetty service, unless you've added custom configuration or modules to do so.