1

Is there a way to filter request that look like "GET http://example.com" but not filter one that look like "GET /index.html"? In other words what is the Nginx variable that can be used in the "If" clause?

The reason for asking this is that I see in my web site log multiple requests that look like: "GET http://somesite.com/proxyheader" from users that search for free proxy servers.

2 Answers 2

2

This works for me in 0.8.41:

if ($request ~* "^[^ ]+[ ]+[^:]+://" ) { return 400; }
2
  • Exactly what I was looking for.
    – Ross
    Oct 27, 2010 at 17:17
  • yes, but what's the context? does it go within server {}? Jun 11, 2019 at 22:34
0

Have you checked the variables in the nginx config?

Link: link text

Can you show us an excerpt of your log files? Is the http://somesite... a parameter (http://example.com/http://seomsite...)?

Regards, Ben.

2
  • Yes I checked them, but still could not get the one that can be used to differentiate between two types of request. The log lines look like this "xxx.xxx.xxx.xxx - - [27/Oct/2010:08:57:41 +0000] "GET example.com/proxyheader.php HTTP/1.1" 200 556 "-"
    – Ross
    Oct 27, 2010 at 9:06
  • In this case apply a regex to your $request variable. Set an appropriate return code (e.g. 403) and check your logs again. Good luck! Oct 27, 2010 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .