fastcgi_param HTTP_PROXY ""; is the soluntion, but why didn't they also mention HTTPS_PROXY? I have a HTTPS website, not HTTP.
Should I also add
fastcgi_param HTTPS_PROXY ""; or not?
Stop changing the title.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Even if the context is missing I think you are referring to the httpoxy vulnerability where it is possible for an remote attacker to set the HTTP_PROXY environment variable using a HTTP
Proxy header. The base of this vulnerability is that in a CGI environment the
HTTP_xxx environment variable is set if the HTTP header
xxx exists. Since this only affects
HTTP_* variables and not
HTTPS_* variables it does not affect
Apart from that both
HTTPS_PROXY are only relevant for requests done by the CGI script and is not related to how your site gets accessed.