MQTT Broker & Application Layer

Question

I've successfully set up a proof-of-concept IM solution supporting one-to-one, group-chat and presence in under 45m using RabbitMQ as an MQTT broker and MQTT.fx as client (from within our local network). Now I'd like to build upon this as the chat component of our existing, public-facing product. As such, I have a couple of questions:

1. In the typical scenario, are the broker's nodes (be it RabbitMQ, Mosquitto, etc.) exposed publicly to the Internet (maybe behind a load balancer)? Do Android and iOS clients just connect directly to the broker or is there usually an intermediate, applicational layer?
2. I, of course, want to add authentication and some pre-/post-processing to the messages, so I do need an applicational layer, I guess. What is the most efficient way to place this layer between the broker and clients? Our applicational layer is Java (Spring Boot, to be precise).

Answer 1

1. MQTT Brokers do get exposed to internet provided with TLS encryption which is easy to setup, also in a bidirectional way.

2. MQTT has its own authentication mechanism and provided that is running over TLS the passwords are never sent with plain text.

You can find more information on this guide. http://www.hivemq.com/mqtt-security-fundamentals-tls-ssl/