# Nginx and ../../ requests

**URL:** <https://www.ruby-forum.com/t/nginx-and-requests/191229>\
**Category:** NGINX\
**Created:** [July 7, 2010, 7:00pm UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229 "2010-07-07T19:00:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [July 7, 2010, 7:00pm UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229/1 "2010-07-07T19:00:28Z")

</div>

Hi,

How does Nginx behave against …/…/ hackish requests? Does it allow  
requests to go outside of the root directive?

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [July 7, 2010, 7:56pm UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229/2 "2010-07-07T19:56:47Z")

</div>

On Wed, Jul 07, 2010 at 07:00:28PM +0200, Fernando P. wrote:

> How does Nginx behave against ../../ hackish requests? Does it allow  
> requests to go outside of the root directive?

No, it does not allow.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [July 7, 2010, 8:56pm UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229/3 "2010-07-07T20:56:08Z")

</div>

> No, it does not allow.

Thanks Igor.

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [July 8, 2010, 12:14am UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229/4 "2010-07-08T00:14:55Z")

</div>

Hi,

Is this the same behavior when it’s proxying requests to another server  
(apache/ruby/fastcgi, etc)?

Thanks

Posted at Nginx Forum:

> **[Re: Nginx and ../../ requests](https://forum.nginx.org/read.php?2,106337,106428#msg-106428)**
>
> Hi, How does Nginx behave against ../../ hackish requests? Does it allow requests to go outside of the root directive? -- Posted via http://www.ruby-forum.com/. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ nginx mailing list nginx@nginx.org

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [July 8, 2010, 8:13am UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229/5 "2010-07-08T08:13:03Z")

</div>

On Wed, Jul 07, 2010 at 06:14:04PM -0400, nfn wrote:

> Hi,
> 
> Is this the same behavior when it’s proxying requests to another server  
> (apache/ruby/fastcgi, etc)?

Yes.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [July 8, 2010, 10:12am UTC](https://www.ruby-forum.com/t/nginx-and-requests/191229/6 "2010-07-08T10:12:29Z")

</div>

Thanks Igor!

Posted at Nginx Forum:

> **[Re: Nginx and ../../ requests](https://forum.nginx.org/read.php?2,106337,106530#msg-106530)**
>
> Hi, How does Nginx behave against ../../ hackish requests? Does it allow requests to go outside of the root directive? -- Posted via http://www.ruby-forum.com/. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ nginx mailing list nginx@nginx.org