gixy

Use this static analyzer to check for such mistakes: https://github.com/yandex/gixy

FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)

This article briefly mentions a very useful analysis tool for NGINX configuration: Gixy. It looks for the following misconfigurations[0]: - [ssrf] Server Side Request Forgery - [http_splitting] HTTP Splitting - [origins] Problems with referrer/origin validation - [add_header_redefinition] Redefining of response headers by "add_header" directive - [host_spoofing] Request's Host header forgery - [valid_referers] none in valid_referers - [add_header_multiline] Multiline response headers - [alias_traversal] Path traversal via misconfigured alias The alias traversal gotcha is one of the most pernicious I've seen. A single, seemingly innocuous '/' is the difference between a path traversal vulnerability or not. [0]: https://github.com/yandex/gixy#what-it-can-do

Though deprecated, https://github.com/yandex/gixy is a nice checker for these kind of issues.

Nginx requires too much configuration. It is very brittle if you do not have a full time DevOps person monitoring things. E.g. for production web apps, take a look at the amount of tooling that has been developed to manage Nginx: https://www.digitalocean.com/community/tools/nginx https://github.com/yandex/gixy This is not a criticism of Nginx per se, it comes from a time when Apache is the only other alternative and end-user UX is hardly priority. An analogy would be systemd and pm2, pm2 have few advantages over systemd on paper but in practice it has a much more pleasant UX and saner defaults even though it requires a separate installation on most servers while systemd is available by default. It is the difference between Heroku and AWS. For the 99th percentile of efficiency Nginx still beats Traefik and Caddy, but sometimes scaling serv

Woah this is awesome, we just ran this and found that we have this[1] issue in our config. Thanks for this! I'm going to add it to our CI runs. Edit: the add_header config option is quite confusing and I had absolutely no idea it behaved like that, I highly suggest trying this tool on your configs and seeing what it reports. 1. https://github.com/yandex/gixy/blob/master/docs/en/plugins/a...