Nginx – Reject requests with special unicode chars in Nginx

nginx

I'd like to block/deny all requests that have one or more non-ascii chars in it.

For instance, I'm getting requests like these:

/\ufffd?s=p&z=\ufffd&g=\ufffd&o=2

Where \ufffd is the "replacement character".

This is causing my web app to email me errors because my database isn't yet UTF-8 (long story short).

I know I should fix the problem, not hide it, but until I do, blocking all weird requests from getting to the application will prevent my mail box from filling with errors.

I also know that all URLs in this particular website do not contain non-ascii chars, so this quick fix won't break anything.

Thanks!

Best Answer

You can match such a url by using the replacement character itself in the location directive:

location /� {
  return 400; # Or whatever you would like to do.
}

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Best Answer

Related Solutions

nginx HTTPS – How to Serve HTTPS with Same Config as HTTP

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

Related Topic