Score:0

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

in flag

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability?

I understand that the best way to prevent HTTP Request Smuggling is by sending HTTP/2 requests end to end. Since NGINX when used as reverseproxy sends requests upstream using HTTP/1.1, I believe this exposes the backend to HTTP Request Smuggling.

Apart from the web application firewall(WAF) from NGINX App Protect, is there any other solution to tackle this vulnerability? I am relatively new to NGINX and reverse proxies, if NGINX does have an alternate solution, please do share.

Thank you

djdomi avatar
za flag
i am unsure vut i believe that this question would be better fit on security instead of here even its a interesting sounding question
in flag
I've posted the question here because this involves understanding how Nginx and its users tackle the vulnerability. Could you please share the link for security if thats a different forum, I'll post the question there as well.
djdomi avatar
za flag
i think its: https://security.stackexchange.com/
in flag
Thank you. I have posted the question there as well.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.