Skip to content

Instantly share code, notes, and snippets.

@juanpablocs
Forked from onnimonni/ssl_client_cert_if.conf
Last active September 14, 2020 04:35
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save juanpablocs/f860c77033c75ff8e6aed135a02f008f to your computer and use it in GitHub Desktop.
Save juanpablocs/f860c77033c75ff8e6aed135a02f008f to your computer and use it in GitHub Desktop.
How to regex from nginx variable with map directive
##
# I wanted to use same ssl client certificate CA in nginx for multple client certs
# but restrict the users outside our organisation accessing everything.
# Because I can decide what to put into the emailAddress I can force verify everything and only pass the proper users.
##
##
# This way you can restrict users only with email addresses from @koodimonni.fi
# Put this into http context in nginx configs
##
map $ssl_client_s_dn $koodimonni_user {
default "false";
~emailAddress=.*@koodimonni.fi "true";
}
##
# Use the result in if
##
if ($koodimonni_user = "true") {
proxy_pass some_super_secure_server;
}
map $request_uri $isAttack {
default "false";
~*\?[0-9] "true";
~*\?\= "true";
~*\?busqueda "false";
~*\?_ "false";
~*\?utm "false";
~*\?fbclid "false";
~*\? "true";
}
server {
listen 80;
server_name site.me;
location / {
if ($isAttack = "true") {
add_header Content-Type text/html;
return 200 ":/";
...
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarder-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://my_app;
proxy_redirect off;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment