Common Nginx misconfigurations that leave your web server open to attack
The one about proxy_pass blindly forwarding syntactically malformed requests and silently failing to process the response is astonishing.<p>It doesn&#x27;t appear to be documented.  Looking through NginX documentation at <a href="http:&#x2F;&#x2F;nginx.org&#x2F;en&#x2F;docs&#x2F;http&#x2F;ngx_http_proxy_module.html" rel="nofollow">http:&#x2F;&#x2F;nginx.org&#x2F;en&#x2F;docs&#x2F;http&#x2F;ngx_http_proxy_module.html</a> I don&#x27;t see anything (e.g. under proxy_hide_header) to say it&#x27;s sometimes not applied, and there doesn&#x27;t appear to be any option to prevent this blind forwarding.<p>I would never have expected the backend to receive invalid HTTP from NginX, but more importantly it&#x27;s not uncommon for backends to send an extra header or two to tell NginX how to serve the response, with NginX removing those headers before serving.<p>How do you even handle this properly?  Checking for valid HTTP might not be enough, as you need to exactly match whatever NginX&#x27;s idea of valid is, rather than matching the HTTP spec.