3 ms·
I remember someone posting an article of common nginx config security mistakes but can't find it. Does anyone remember? I would like to read through that again
by cosmiccrisp 5y ago
I remember someone posting an article of common nginx config security mistakes but can't find it. Does anyone remember? I would like to read through that again as well.
- WaxedChewbacca 5y ago
- iancarroll 5y agoNot a comprehensive article, but the worst security footgun, by far (IMO), is $uri. It’s completely unsafe to use $uri in basically any directives! You cannot redirect using it, proxy_pass using it, or you will have a bad time. https://reversebrain.github.io/2021/03/29/The-story-of-Nginx-and-uri-variable/ https://reversebrain.github.io/2021/03/29/The-story-of-Nginx...
- cosmiccrisp 5y agoThanks! That is good info.