0

Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is. My question is since im compiling the module by myself, how secure is it if i'm not keeping up with the current version. I'm not a specialist here, so if i'm having an outdated module is it maybe a security risk for the machine or is it not that important since it is an "internal" module which only reads the contents of the maxmind database? The database is on the server itself.

1
  • 1
    Why not just do it at the application level? That will be much easier to change in the future. If you have to rebuild the web server to update the module, then you will do it less often and will also have to worry about downtime. Application updates are much easier and downtime is not usually a concern. There are definitely plenty of ways to lookup country from IP in any application – Conor Mancone Jul 22 '20 at 12:05
1

There's nothing bad in that as long as you're subscribed to any security updates list and keep an eye on vulnerabilities.

Also, do subscribe to this module future releases: if you see any mentions of CVEs or fixed bugs, you may want to upgrade.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.