ACL via X-Forwarded-For

Simple pattern (1 r-proxy)

server {
    listen       80;
    server_name  localhost;
    set_real_ip_from   172.17.0.1/32;
    real_ip_header     X-Forwarded-For;
    #real_ip_recursive off; = default

    location / {
        allow x.x.x.x/32;
        deny all;
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

test pattern

XFF = x.x.x.x & remote-add = 172.17.0.1 : Allowed
XFF = x.x.x.x,10.10.10.10 & remote-add = 172.17.0.1 : Denied
XFF = x.x.x.x,172.17.0.1 & remote-add = 172.17.0.1 : Denied

I guess..　　

When we set single set_real_ip_from only , evaluate most right side.

Multi (r-proxy)

server {
    listen       80;
    server_name  localhost;
    set_real_ip_from   172.17.0.1/32;
    set_real_ip_from   10.10.10.10/32;
    real_ip_header     X-Forwarded-For;
    real_ip_recursive on;

    location / {
        allow x.x.x.x/32;
        deny all;
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

test pattern

XFF = x.x.x.x & remote-add = 172.17.0.1 : Allowed
XFF = x.x.x.x,10.10.10.10 & remote-add = 172.17.0.1 : Allowed
XFF = x.x.x.x,172.17.0.1 & remote-add = 172.17.0.1 : Allowed
XFF = x.x.x.x,10.10.10.10,5,5,5,5 & remote-add = 172.17.0.1 : Denied
XFF = x.x.x.x,5,5,5,5,10.10.10.10 & remote-add = 172.17.0.1 : Denied
XFF = x.x.x.x,172.17.0.1,10.10.10.10 & remote-add = 172.17.0.1 : Allowd

If you set real_ip_recursive on, eval set_real_ip_from in XFF. But set_real_ip_from should chained nothing to do with set_ral_ip_from oder @ config-file.
So, if attacker knows both 172.17.0.1/32 , 10.10.10.10/32 and allowed IP, crack it!

Stop & Start & Signals

start
stop kill -QUIT <nginx master process id>

signal

HUP gracefully!, for new configuration reload
USR1 Reopen the log files! Nice! for logrotate
USR2 Upgrade Executable on the fly... realy? https://www.nginx.com/resources/wiki/start/topics/tutorials/commandline/#upgrading-to-a-new-binary-on-the-fly
KILL Abort!

For logrotate, use USR1

setEnvIf X-Forwarded-Proto => HTTPS

fastcgi_param HTTPS on:

  fastcgi_pass   ...
  fastcgi_index  index.php;
  fastcgi_param  SCRIPT_FILENAME $document_root/$fastcgi_script_name;
  fastcgi_param  HTTPS on;
  include        fastcgi_params;

Redirect http => https behind ELB

        if ($http_x_forwarded_proto != "https") {
           return 301 https://$http_host$request_uri;
        }

use some conditions @ if directive

Use concat strings insted of...

    if ($request_uri = /) {
      set $test  root;
    }

    if ($host ~* teambox.com) {
      set $test  "${test}+teambox.com";
    }

    if ($http_cookie !~* "auth_token") {
      set $test  "${test}+no_auth_token";
    }

    if ($test = "root+teambox.com+no_auth_token") {
      proxy_pass http://teambox-cms.heroku.com;
      break;
    }

location ....