Common Nginx misconfigurations that leave your web server open to attack
A lot of these look like not-so-great design choices in the way nginx is configured and how it handles paths.Sometimes the behavior that leads to security problems here may be desirable, but it probably shouldn't be the default.For instance "location /api {" probably shouldn't match "/api../" by default. Instead it should be treated like a file system would. The "prefix" matching should be
a different configuration option like "prefix /api {".