mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-09-02 10:10:34 +00:00
19086ce709
Fixes #5207 - Security issue where Force SSL leaks host existence When both Force SSL and an Access List are active on a Proxy Host, HTTP requests from unauthorized IPs were receiving a 301 redirect instead of being blocked. This allowed attackers to enumerate valid hosts by brute-forcing the Host header. Solution: Use nginx geo module to check IP access before the SSL redirect. Only allowed IPs get redirected to HTTPS; denied IPs fall through to the access phase and receive 403. Changes: - Add geo block template for IP-based access control - Modify _forced_ssl.conf to check geo variable before redirecting - Generate geo config files when access lists are created/updated - Include geo configs at http level in nginx.conf - Create access_geo directory on startup |
||
|---|---|---|
| .. | ||
| certbot | ||
| config | ||
| internal | ||
| lib | ||
| migrations | ||
| models | ||
| routes | ||
| schema | ||
| scripts | ||
| templates | ||
| .gitignore | ||
| app.js | ||
| biome.json | ||
| db.js | ||
| index.js | ||
| knexfile.js | ||
| logger.js | ||
| migrate.js | ||
| nodemon.json | ||
| package.json | ||
| setup.js | ||
| validate-schema.js | ||
| yarn.lock | ||