Hot answers tagged

3

Is it common for nginx to allow access to a shell? No. Is it common for people to create/configure websites that allow access to the shell? Kind of. Unfortunately. Does it cost nothing to check? Yes.


2

Like a normal (not same-site) cookie the Authorization header for Basic Authentication is always send with a normal HTTP request when the site is accessed and credentials are known, no matter if cross-site or not. There is no way to specify a different policy for this header.


1

This format is used by a kind of HTTP proxy. Unless your server is actually misconfigured or hacked to be used as a proxy (you should get rid of the browser limitation and test it out), it may have the following possibilities: Someone is scanning a wide range of IP addresses for open proxies. Someone is testing the availability of an open proxy once existed ...


1

There's nothing bad in that as long as you're subscribed to any security updates list and keep an eye on vulnerabilities. Also, do subscribe to this module future releases: if you see any mentions of CVEs or fixed bugs, you may want to upgrade.


Only top voted, non community-wiki answers of a minimum length are eligible