Minor "bug" in nginx
mdounin at mdounin.ru
Thu Apr 30 02:01:28 MSD 2009
On Wed, Apr 29, 2009 at 01:17:20PM -0700, Michael Shadle wrote:
> This is not really a 'bug' I think, but it is something that raises a
> security flag, we got dinged on it. Now, it does not appear to
> actually execute the proxy request, but it should return something
> other than HTTP 200.
> [mike at lvs01 ~]$ telnet test.foo.org 80
> Trying 18.104.22.168...
> Connected to test.foo.org.
> Escape character is '^]'.
> GET http://xmike.com HTTP/1.1
> Host: xmike.com
> HTTP/1.1 200 OK
> Server: nginx
> Date: Wed, 29 Apr 2009 20:08:16 GMT
> Content-Type: text/html; charset=utf-8
> Content-Length: 27
> Last-Modified: Tue, 09 Dec 2008 19:54:37 GMT
> Connection: keep-alive
> Accept-Ranges: bytes
> telnet> quit
> I don't believe nginx should allow for GET http://someforeignhost/
> should it? Is there an actual use model for this?
It MUST per RFC2616. There is no difference between
GET http://example.com/ HTTP/1.1
GET / HTTP/1.1
See RFC2616 for details (5.2 The Resource Identified by a Request).
And there is no such thing as "someforeignhost". Any request for
any host received by nginx will be served at least in default
server for the listen socket in question, see docs for details.
It's up to you to configure nginx to return something other than
200 for hosts not explicitly configured, e.g.:
listen 80 default;
In the above configuration requests for one.example.com will be
served as usual, while anything other will return 404 error.
More information about the nginx