Common Nginx misconfigurations that leave your web server open to attack
A lot of these look like not-so-great design choices in the way nginx is configured and how it handles paths.<p>Sometimes the behavior that leads to security problems here may be desirable, but it probably shouldn't be the default.<p>For instance "location /api {" probably shouldn't match "/api../" by default. Instead it should be treated like a file system would. The "prefix" matching should be
a different configuration option like "prefix /api {".