Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to filter request that look like "GET http://example.com" but not filter one that look like "GET /index.html"? In other words what is the Nginx variable that can be used in the "If" clause?

The reason for asking this is that I see in my web site log multiple requests that look like: "GET http://somesite.com/proxyheader" from users that search for free proxy servers.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This works for me in 0.8.41:

if ($request ~* "^[^ ]+[ ]+[^:]+://" ) { return 400; }
share|improve this answer
    
Exactly what I was looking for. –  Ross Oct 27 '10 at 17:17

Have you checked the variables in the nginx config?

Link: link text

Can you show us an excerpt of your log files? Is the http://somesite... a parameter (http://example.com/http://seomsite...)?

Regards, Ben.

share|improve this answer
    
Yes I checked them, but still could not get the one that can be used to differentiate between two types of request. The log lines look like this "xxx.xxx.xxx.xxx - - [27/Oct/2010:08:57:41 +0000] "GET example.com/proxyheader.php HTTP/1.1" 200 556 "-" –  Ross Oct 27 '10 at 9:06
    
In this case apply a regex to your $request variable. Set an appropriate return code (e.g. 403) and check your logs again. Good luck! –  Benedikt Niessen Oct 27 '10 at 13:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.