xuthus/pigallery2
1
0
Fork 0
mirror of https://github.com/xuthus83/pigallery2.git synced 2024-11-03 21:04:03 +08:00
Code Actions Projects Activity

Restricting non get methods to the /pgapi subdomain in the recommended nginx config #214, #519

Browse Source
This commit is contained in:
Patrik J. Braun 2022-12-10 00:57:31 +01:00
parent 3ac0bb22b2
commit 534f7187c4
2 changed files with 28 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
docker/docker-compose/default/nginx.conf
View File

@ -56,7 +56,9 @@ http {
gzip on; gzip on;
location / { # Only allow all methods (GET,POST,PUT,etc..) for root (/pgapi).
# see https://github.com/bpatrik/pigallery2/issues/214
location /pgapi {
proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2' proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2'
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
@ -65,6 +67,17 @@ http {
proxy_cache_bypass $http_upgrade; proxy_cache_bypass $http_upgrade;
} }
location / {
limit_except GET {
deny all;
}
proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2'
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
listen 443 ssl default_server; listen 443 ssl default_server;
listen [::]:443 ssl default_server; listen [::]:443 ssl default_server;

15
docker/docker-compose/with-mysql/nginx.conf
View File

@ -56,7 +56,9 @@ http {
gzip on; gzip on;
location / { # Only allow all methods (GET,POST,PUT,etc..) for root (/pgapi).
# see https://github.com/bpatrik/pigallery2/issues/214
location /pgapi {
proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2' proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2'
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
@ -65,6 +67,17 @@ http {
proxy_cache_bypass $http_upgrade; proxy_cache_bypass $http_upgrade;
} }
location / {
limit_except GET {
deny all;
}
proxy_pass http://pigallery2:80; # forwarding to the other container, named 'pigallery2'
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
listen 443 ssl default_server; listen 443 ssl default_server;
listen [::]:443 ssl default_server; listen [::]:443 ssl default_server;