Questions tagged [nginx]

nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

16 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
131 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
's user avatar
2 votes
0 answers
156 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
2 votes
0 answers
547 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
2 votes
0 answers
550 views

Startcom StartSSL + nginx client certificate

Startcom issues client certs. I'm using mine for seamless authentication in nginx as follows, in somewhat the same manner as was suggested by this Q/A: server { ssl_certificate /path/to/my/...
's user avatar
1 vote
0 answers
66 views

When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?

I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server. Basically, if web server A receives TCP traffic ...
1 vote
1 answer
267 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
1 vote
0 answers
638 views

user permissions and nginx with git hook for deployment

So I am trying to set up a webserver which will use nginx to serve a static site (for now). I set up a git repo that I want to push to in order to make deployment easy (using this guide: https://www....
1 vote
0 answers
626 views

nginx request redirected

I've noticed in my nginx access.log entries like this: XX.XX.XX.XX - - [05/Jan/2017:00:21:43 +0100] "GET / HTTP/1.1" 301 178 "-" "libwww-perl/6.05" This is weird because i've implemented GeoIP ...
  • 183
0 votes
0 answers
34 views

Which is more secure and better practice? Setting up a reverse proxy on backend with localhost or on a separate VM and route to other VMs/services?

I wanna know if it's better in terms of security, availability and best practice to set up a nginx reverse proxy on my backend and use it with localhost or to set up a VM that handles everything for ...
0 votes
0 answers
43 views

Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)

While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds. If I ...
0 votes
0 answers
124 views

Possible VNC-over-HTTP exploit involving Nginx?

I have the following setup Nginx + php-fpm, Nginx is running on port 80 and 443. Recently I noticed that connections were made from this servers port 80 to a remote machine on port 580x. [ src port is ...
  • 31
0 votes
1 answer
146 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
0 votes
0 answers
97 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
0 votes
0 answers
78 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
  • 190
0 votes
0 answers
284 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
  • 101
0 votes
0 answers
251 views

what kind of attack is this

Im developing a website on test server and so when debugging some stuff I had to look in access log, this is a small chunk of what I saw: 37.99.49.203 - - [13/May/2019:17:51:34 +0200] "H\x1E\xF3qxZ\...