Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a Ruby on Rails app behind Nginx. Every once in a while I see requests like GET /phpmyadmin or GET /wp-login.php. Since I don't have those tools installed, it's obvious that those are from someone trying to get into my site.
Does it make sense to add a couple rules to my Nginx config to automatically return 403 to those requests and not bother the primary app with having to return 404?
Thank you.
Denying obvious malicious requests having actual payloads like SQL injections or XSS attempts would be building a web application firewall (WAF), which is a useful defence-in-depth strategy against unknown or unpatched vulnerabilities. Denying requests that would already result in 404 errors does not add any security from that perspective, but it might still be a good idea to do it on the reverse proxy as it reduces the load on the backend server(s).
It does not otherwise matter whether you reply with 404 or 403 but using a different status code you give free hints on what you have denied manually. Consider moving the task to the reverse proxy but continuing using the status code 404.
Also, take a look at the proxy_cache_valid directive; if appropriate, you could e.g. cache all 404 responses for an hour with proxy_cache_valid 404 1h;.
