2

I had both production (www.myexample.com) and development (dev.myexample.com) on a single server, using server blocks and separate directories, with both listening on port 80. This worked fine.

Now I have installed the SSL certificate and enabled SSL mode in the site config file. At the same time I changed the listening port from 80 to 443, so the site should not respond on port 80, only on port 443. The development site is still running as it was.

Now it appears that in stead of an error, I get the development site when I connect to http://www.myexample.com.

To fix this problem I added a real "default" server block (server_name set to _) and pointing to a directory which contains no files.

Is there a better way? If I want a real default web site, I don't want it to be shown for a known hostname. I am guessing I have to create a server block listening fr www.myexaple.com:80 and configure it to somehow reject all page requests, but how?

How can I completely stop responding to any requests for a site I do not host?

3
  • 2
    I am afraid that you will have to post your NGinx config file(s) to help us debug this...
    – krisFR
    May 3, 2015 at 20:44
  • A real default server block has default_serverafter the listen directive port / IP address. It is not defined by the use of an invalid host name. May 3, 2015 at 21:37
  • «pointing to a directory which contains no files», you could use return 404 or return 444 instead. But in general it's the only right way
    – Alexey Ten
    May 5, 2015 at 9:05

1 Answer 1

2

It is always a good idea to configure a default server with an invalid hostname, this makes sure that clients without any host header field set (or with a host you have not configured) are rejected.

server {
    listen              [::]:80 backlog=65536 default_server deferred ipv6only=off rcvbuf=16k sndbuf=512k;
    server_name         _;
    return              403;
}

server {
    listen              [::]:443 backlog=65536 default_server deferred ipv6only=off rcvbuf=16k sndbuf=512k spdy ssl;
    server_name         _;
    ssl_certificate     certificates/_/pem;
    ssl_certificate_key certificates/_/key;
    return              403;
}

https://github.com/Fleshgrinder/nginx-configuration

As you can see, I return with a 403 Access Forbidden status code, since this is the most appropriate one for my use case (see comment below). If you simply want to return absolutely nothing, use the special nginx code 444.

3
  • My first instinct is that 403 is not the best because the server is not so much refusing to serve the request as it is unable to serve the request for a site that it doesn't host. So 404 feels more appropriate. But thank you, your solution appears to be what I need, and I'll accept your answer as soon as I've had a moment to try it out.
    – Johan
    May 5, 2015 at 12:27
  • And 421 - Misdirected request seems very interesting in this situation but I think it is a little premature to send HTTP/2 status codes, maybe in 6 months time....
    – Johan
    May 5, 2015 at 12:30
  • 403 is appropriate in my use case, since I want to forbid access to clients which do not send the HTTP host header field. Your use case is slightly different and I think that 404 is a good choice. I think six months is not enough, maybe six years. May 5, 2015 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .