# Server hardening without "If" conditions

**URL:** <https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728>\
**Category:** NGINX\
**Created:** [June 1, 2011, 2:48pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728 "2011-06-01T14:48:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [June 1, 2011, 2:48pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/1 "2011-06-01T14:48:26Z")

</div>

Hi. I notice that nginx with just the location rules and usual  
directives results in mind-blowing performance. Apache Bench test shows  
“115,000 requests per second” can be handled.

However, when I add a simple rule:

```
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
  return 444;
}

```

Which I think is important from a point of view of getting rid of so  
much junk that hits any modern server, the requests per second fall to  
“1,200” !!!

Is there any way around this? I would, if possible, prefer that my main  
web server be able to handle such basic stuff.

Welcome any thoughts. Thanks!

Posted at Nginx Forum:

> **[Server hardening without "If" conditions](https://forum.nginx.org/read.php?2,202965,202965#msg-202965)**
>
> Hi. I notice that nginx with just the location rules and usual directives results in mind-blowing performance. Apache Bench test shows "115,000 requests per second" can be handled. However, when I add a simple rule: if ($request\_method !~...

---

<div class="post-metadata">

**Author:** ![pk899](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c68b51/32.png) [@pk899](https://www.ruby-forum.com/u/pk899)\
**Post date:** [June 1, 2011, 2:57pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/2 "2011-06-01T14:57:43Z")

</div>

On Wed, Jun 01, 2011 at 08:47:48AM -0400, pk899 wrote:

> Which I think is important from a point of view of getting rid of so  
> much junk that hits any modern server, the requests per second fall to  
> “1,200” !!!
> 
> Is there any way around this? I would, if possible, prefer that my main  
> web server be able to handle such basic stuff.
> 
> Welcome any thoughts. Thanks!
> 
> Posted at Nginx Forum:  
> [http://forum.nginx.org/read.php?2,202965,202965#msg-202965](http://forum.nginx.org/read.php?2,202965,202965#msg-202965)

Well, the test you added includes the regular expression calculations as  
well.  
Can nginx use three simpler exact string matches instead? It may be  
faster.

Cheers,  
Ken

---

<div class="post-metadata">

**Author:** ![pk899](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c68b51/32.png) [@pk899](https://www.ruby-forum.com/u/pk899)\
**Post date:** [June 1, 2011, 3:02pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/3 "2011-06-01T15:02:41Z")

</div>

## ktm2 Wrote:

> > ```
> > if ($request_method !~ ^(GET|HEAD|POST)$ ) {
> > 
> > ```
> 
> possible, prefer that my main  
> expression calculations as well.  
> Can nginx use three simpler exact string matches  
> instead? It may be faster.
> 
> Cheers,  
> Ken

Thanks Ken. How would you write this though?

```
if ($request_method != "GET" and $request_method != "POST" and

```

$request\_method != “HEAD”) {  
return 444;  
}

This is not correct syntax?

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,202965,202969#msg-202969](http://forum.nginx.org/read.php?2,202965,202969#msg-202969)

---

<div class="post-metadata">

**Author:** ![pk899](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c68b51/32.png) [@pk899](https://www.ruby-forum.com/u/pk899)\
**Post date:** [June 1, 2011, 3:03pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/4 "2011-06-01T15:03:55Z")

</div>

On Wed, Jun 1, 2011 at 7:47 PM, pk899 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Which I think is important from a point of view of getting rid of so  
> much junk that hits any modern server, the requests per second fall to  
> “1,200” !!!

I’m interested in what way this is important. Especially since nginx  
will just return error 400 on bad requests.

---

<div class="post-metadata">

**Author:** ![pk899](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c68b51/32.png) [@pk899](https://www.ruby-forum.com/u/pk899)\
**Post date:** [June 1, 2011, 3:13pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/5 "2011-06-01T15:13:15Z")

</div>

On Wed, Jun 01, 2011 at 08:47:48AM -0400, pk899 wrote:

> Which I think is important from a point of view of getting rid of so  
> much junk that hits any modern server, the requests per second fall to  
> “1,200” !!!
> 
> Is there any way around this? I would, if possible, prefer that my main  
> web server be able to handle such basic stuff.

It’s strange result. The “if” and regex slow down processing,  
but not by 3 orders of magnitude.

–  
Igor S.

---

<div class="post-metadata">

**Author:** ![pk899](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c68b51/32.png) [@pk899](https://www.ruby-forum.com/u/pk899)\
**Post date:** [June 1, 2011, 3:36pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/6 "2011-06-01T15:36:47Z")

</div>

On Wed, Jun 01, 2011 at 09:02:23AM -0400, pk899 wrote:

> > > However, when I add a simple rule:
> 
> Thanks Ken. How would you write this though?
> 
> ```
> if ($request_method != "GET" and $request_method != "POST" and
> 
> ```
> 
> $request\_method != “HEAD”) {  
> return 444;  
> }
> 
> This is not correct syntax?
> 
> Posted at Nginx Forum:  
> [http://forum.nginx.org/read.php?2,202965,202969#msg-202969](http://forum.nginx.org/read.php?2,202965,202969#msg-202969)

I am just learning about nginx so I am not familiar with the syntax yet.  
But  
your query would still require checking three separate conditions before  
proceeding.  
Could check three separate times and proceed after each one:

if ($request\_method == “GET”) {  
go…  
}

if ($request\_method == “POST”) {  
go…  
}  
…

return 444;

And order them most likely to least likely.

Cheers,  
Ken

---

<div class="post-metadata">

**Author:** ![pk899](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/c68b51/32.png) [@pk899](https://www.ruby-forum.com/u/pk899)\
**Post date:** [June 1, 2011, 3:25pm UTC](https://www.ruby-forum.com/t/server-hardening-without-if-conditions/207728/7 "2011-06-01T15:25:01Z")

</div>

On 1 June 2011 15:13, Igor S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > Which I think is important from a point of view of getting rid of so  
> > much junk that hits any modern server, the requests per second fall to  
> > “1,200” !!!

How scientific is that test? Is 115,000 requests per second an  
expected baseline performance? Did anything else change between tests?

And as someone else suggested, this is not really something you should  
have to do in nginx in any case. It’s like closing ports you don’t  
use. If your system is secure there’s no need. If your system isn’t  
secure it won’t help.

Thomas