‎Well this is interesting. Since this situation should never happen (I think) in real life, should this code be always implemented? Any downsides?
--------

If requests without the “Host” header field should not be allowed, a server that just drops the requests can be defined:

server {
    listen      80;
    server_name "";
    return      444;
}

Here, the server name is set to an empty string that will match requests without the “Host” header field, and a special nginx’s non-standard code 444 is returned that closes the connection.

Since version 0.8.48, this is the default setting for the server name, so theserver_name "" can be omitted. In earlier versions, the machine’s hostname was used as a default server name.‎

From: Igal @ Lucee.org
Sent: Friday, May 19, 2017 4:08 PM
To: li...@lazygranch.com; nginx@nginx.org; Alex Samad
Subject: Re: How to restrict acces to specific friendly URL by IP in Wordpress site?

On 5/19/2017 4:02 PM, li...@lazygranch.com wrote:


A non-standard status code used to instruct nginx to close the connection without sending a response to the client, most commonly used to deny malicious or malformed requests.

This status code is not seen by the client, it only appears in nginx log files.


I stand corrected.  Here's a better reference:
http://nginx.org/en/docs/http/request_processing.html



_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx

Reply via email to