Forked from onnimonni/ssl_client_cert_if.conf
Last active
September 14, 2020 04:35
How to regex from nginx variable with map directive
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## | |
# I wanted to use same ssl client certificate CA in nginx for multple client certs | |
# but restrict the users outside our organisation accessing everything. | |
# Because I can decide what to put into the emailAddress I can force verify everything and only pass the proper users. | |
## | |
## | |
# This way you can restrict users only with email addresses from @koodimonni.fi | |
# Put this into http context in nginx configs | |
## | |
map $ssl_client_s_dn $koodimonni_user { | |
default "false"; | |
~emailAddress=.*@koodimonni.fi "true"; | |
} | |
## | |
# Use the result in if | |
## | |
if ($koodimonni_user = "true") { | |
proxy_pass some_super_secure_server; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
map $request_uri $isAttack { | |
default "false"; | |
~*\?[0-9] "true"; | |
~*\?\= "true"; | |
~*\?busqueda "false"; | |
~*\?_ "false"; | |
~*\?utm "false"; | |
~*\?fbclid "false"; | |
~*\? "true"; | |
} | |
server { | |
listen 80; | |
server_name site.me; | |
location / { | |
if ($isAttack = "true") { | |
add_header Content-Type text/html; | |
return 200 ":/"; | |
... | |
proxy_set_header X-Real-IP $remote_addr; | |
proxy_set_header X-Forwarder-For $proxy_add_x_forwarded_for; | |
proxy_set_header Host $http_host; | |
proxy_set_header X-NginX-Proxy true; | |
proxy_pass http://my_app; | |
proxy_redirect off; | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment