4 messages in ru.sysoev.nginxRe: Secure nginx
FromSent OnAttachments
Paul GreenwoodFeb 20, 2009 1:01 pm 
Nuno MagalhãesFeb 20, 2009 2:14 pm 
MerlinFeb 20, 2009 3:51 pm 
Dave CheneyFeb 20, 2009 11:10 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: Secure nginxActions...
From:Dave Cheney (da@cheney.net)
Date:Feb 20, 2009 11:10:04 pm
List:ru.sysoev.nginx

Both of those attack vectors relate to web applications, not web servers. Nginx and apache do their part to make sure any data proxied through them to the web application is well formed. However it is the applications job, not the web servers, to make sure it behaves correctly in the presence of untrusted data.

Cheers

Dave

On 21/02/2009, at 8:01 AM, Paul Greenwood wrote:

Is there some specific parameters that are used to lock down nginx for example that might prevent sql injection or css attacks. I have read "Apache Security" and "Preventing Apache Web Attacks" but not quite sure how to apply that knowledge to nginx. I would appreciate any suggestions. Thanks