CODEWITHSUNDEEP
securitynginxluazapcustom-error-handling
Cedric
Cedric

Reputation: 107

Nginx handle 500 internal server error security issue

I am trying to fix a security vulnerability of 500 internal server error disclose location of the file

My issue is similar to that of (https://cdn-images-1.medium.com/max/1600/1*2DAwIEJhgLQd82t5WTgydA.png)

(https://medium.com/volosoft/running-penetration-tests-for-your-website-as-a-simple-developer-with-owasp-zap-493d6a7e182b)

I am tried with

proxy_intercept_errors on;

and

error_page 500

redirection but it didnt help.

Any help on this ?

Upvotes: 1

Views: 2168

Answers (1)

nbari
nbari

Reputation: 26925

This is a basic example of implementing proxy_intercept_errors on;

upstream foo {
    server unix:/tmp/foo.sock;
    keepalive 60;
}

server {
    listen 8080 default_server;
    server_name _;

    location = /errors/5xx.html {
        internal;
        root /tmp;
    }

    location / {
        proxy_pass http://foo;
        proxy_http_version 1.1;
        proxy_redirect off;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_intercept_errors on;
        error_page 500 501 502 503 504 505 404 =200 /errors/5xx.html;   
    }
}

Notice the:

error_page 500 501 502 503 504 505 404 =200 /errors/5xx.html;

This will intercept some 5xx errors and the 404 except and return with a 200

Also, check the /errors/5xx.html location, is using root /tmp; therefore you still need to create the file errors/5xx.html:

$ mkdir /tmp/errors
$ echo "intercepting errors" > /tmp/errors/5xx.hml

You don't necessarily need to a file to reply you request you could also use something like this:

location = /errors/5xx.html {
    internal;
    default_type text/plain;
    return 200 'Hello world!';
}

In your case the 404 File not found could be handle different, for example:

upstream failover{
    server server2:8080;
}

server {
    listen 80;
    server_name example.com;
    root /tmp/test;

    location ~* \.(mp4)$ {
        try_files $uri @failover;
    }

    location @failover {
        proxy_pass http://failover;
    }
}

In this case if the file ending with .mp4 not found it will try another server, then if required you still can intercep the error there.

Upvotes: 1

Related Questions