This is not really a ‘bug’ I think, but it is something that raises a
security flag, we got dinged on it. Now, it does not appear to
actually execute the proxy request, but it should return something
other than HTTP 200.
I don’t believe nginx should allow for GET http://someforeignhost/
should it? Is there an actual use model for this?
If so, I would create a configuration parameter to allow remote
connections, or something. Returning an HTTP error with something back
such as:
510 Not Extended
503 Service Unavailable
501 Not Implemented
416 Requested Range Not Satisfiable
415 Unsupported Media Type
406 Not Acceptable
405 Method Not Allowed
403 Forbidden
400 Bad Request
See RFC2616 for details (5.2 The Resource Identified by a Request).
And there is no such thing as “someforeignhost”. Any request for
any host received by nginx will be served at least in default
server for the listen socket in question, see docs for details.
It’s up to you to configure nginx to return something other than
200 for hosts not explicitly configured, e.g.:
server {
listen 80 default;
server_name_in_redirect off;
return 404;
}
server {
listen 80;
server_name one.example.com;
...
}
In the above configuration requests for one.example.com will be
served as usual, while anything other will return 404 error.
See RFC2616 for details (5.2 The Resource Identified by a Request).
Okay, I see - so it is serving up HTTP 200 because I have a “catchall”
server_name _ somewhere.
I will explain this to the “security company” that did the audit of
our server, that per RFC, it should accept this kind of request, it is
the -action- that is the issue. Maybe also we just failed because I
issued an HTTP 200 instead of a 404 due to the catchall.
See RFC2616 for details (5.2 The Resource Identified by a Request).
Okay, I see - so it is serving up HTTP 200 because I have a “catchall”
server_name _ somewhere.
No. There is nothing special in server_name _. It’s just name.
Default server for every listen socket is always present - it’s
either one with listen … default or first server defined with
listen socket in question.
Maxim D.
This forum is not affiliated to the Ruby language, Ruby on Rails framework, nor any Ruby applications discussed here.