I have an Ubuntu server running Flask app under nginx, this is my conf:
upstream flaskapp {
server 127.0.0.1:5000 fail_timeout=0;
}
server {
listen 80;
server_name _;
location / {
add_header "Access-Control-Allow-Origin" "http://localhost, https://website";
try_files $uri @proxy_to_app;
}
location @proxy_to_app {
proxy_pass http://flaskapp;
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_redirect off;
}
}
server {
listen 443;
ssl on;
ssl_certificate /etc/letsencrypt/live/server/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/server/privkey.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_prefer_server_ciphers on;
location / {
add_header "Access-Control-Allow-Origin" "http://localhost, https://website";
try_files $uri @proxy_to_app;
}
location @proxy_to_app {
proxy_pass http://flaskapp;
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_redirect off;
}
}
There might be a lot of redundant code, since I compiled it from many sources but it works as intended.
Also I observe a lot incoming requests from all types of botnets checking my routes like this:
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:20] "GET /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php HTTP/1.1" 404 356 0.000558
(1805) accepted ('127.0.0.1', 34590)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:22] "GET /sqladmin/index.php HTTP/1.1" 404 356 0.000541
(1805) accepted ('127.0.0.1', 34592)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:22] "GET /sql/index.php HTTP/1.1" 404 356 0.000506
(1805) accepted ('127.0.0.1', 34594)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:23] "GET /SQL/index.php HTTP/1.1" 404 356 0.000543
(1805) accepted ('127.0.0.1', 34596)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:23] "GET /websql/index.php HTTP/1.1" 404 356 0.000570
(1805) accepted ('127.0.0.1', 34598)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:23] "GET /MySQLAdmin/index.php HTTP/1.1" 404 356 0.000566
(1805) accepted ('127.0.0.1', 34600)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:24] "GET /manager/html HTTP/1.1" 404 356 0.000642
(1805) accepted ('127.0.0.1', 34602)
43.226.152.131,127.0.0.1 - - [20/Jul/2020 14:41:24] "POST /axis2/axis2-admin/login HTTP/1.1" 404 356 0.000606
(1805) accepted ('127.0.0.1', 34610)
128.14.134.134,127.0.0.1 - - [20/Jul/2020 14:43:12] "GET / HTTP/1.1" 404 356 0.000507
And this is my own request which is processed correctly:
53.129.29.157,127.0.0.1 - - [20/Jul/2020 20:49:33] "GET /socket.io/?client=KbDHcPsvwELKRJCCFKleAA6HLy&EIO=3&transport=polling&t=NDj_I0I HTTP/1.1" 200 437 0.001434
(1805) accepted ('127.0.0.1', 35076)
I would like to deny all incoming POST and GET requests except for /socket.io/
with client/transport
args (plus SSH on 22 to that machine of course).
This is my try which doesn't work (possibly I need some nested location construction):
location = /socket.io/ {
limit_except GET {
deny all;
}
}
How can I deny everything except GET requests to a specified location with args?