DENY all requests by default (PoLP) set $websocket_same_origin_policy "DENY"; ALLOW non-browser clients if ($http_origin = "") { enter code here
set $websocket_same_origin_policy "ALLOW"; } ALLOW browsers with matching Origin header and ServerName (only browsers reliably set a truthful Origin header) if ($http_origin = $scheme://$server_name) { enter code here
set $websocket_same_origin_policy "ALLOW"; } location /ws { enter code here
# DENY any request that violates the Same Origin Policy enter code here
if ($websocket_same_origin_policy != "ALLOW") { enter code here
return 403; enter code here
} enter code here
proxy_http_version 1.1; enter code here
proxy_set_header Upgrade $http_upgrade; enter code here
proxy_set_header Connection "upgrade"; enter code here
proxy_pass http://localhost:3030; }
enter code here
When I tested with an origin as empty, I will get the 400 code. An Empty origin should return 404, anyone help how to do it
Aucun commentaire:
Enregistrer un commentaire