Sanity check of my config - is it secure?

[Aaron Starr]

Without actually testing anything, can't you do something like this:


location ~* \.(jpe?g|png|gif)$ {
}

location / {
  return 444;
}

I.e., if the extension looks like an image, handle it normally. Otherwise,
in the normal case, return 444 (or whatever error code is appropriate).

Aaron


On Thu, May 26, 2011 at 1:42 PM, António P. P. Almeida <appa at perusio.net>wrote:

> On 26 Mai 2011 21h30 WEST, nginx-forum at nginx.us wrote:
>
> > Thanks for the advice
> >
> > Seems strange that this isn't an easy thing to do. After all, ALL
> > security advise always recommends whitelisting what you want and
> > denying everything else!
>
> The config with two regex locations nested did that. But if you're
> asking for a *catch all* regex that blocks every other extension
> besides css, js, &c, then you're thinking in terms of the
> complement of the set of allowed extensions.
>
> It's easier to enunciate the negative than the positivem due to the
> fact that you're "searching" a wide space.
>
> --- appa
>
>
>
>
> > Posted at Nginx Forum:
> > http://forum.nginx.org/read.php?2,199902,201299#msg-201299
> >
> >
> > _______________________________________________
> > nginx mailing list
> > nginx at nginx.org
> > http://nginx.org/mailman/listinfo/nginx
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://nginx.org/mailman/listinfo/nginx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://nginx.org/pipermail/nginx/attachments/20110526/30c3922d/attachment.html>