Score:0

NGINX proxy fails to disconnect sessions on target Apache server

bf flag
Tom

I have a PHP script running on an Apache server which is responsible for disconnecting all user sessions. For that, it makes a loop that identifies itself as the session that should be disconnected and destroys it. This procedure has no echo.

The Apache log returns HTTP code 200, saying that everything went well.

But NGINX returns the following error.

[error] 512#512: *2699 upstream sent too big header while reading response header from upstream, client: <public-ip>, server: server01.example.com, request: "GET /tste.php HTTP/1.1", upstream: "http://192.168.50.2:80/tste.php", host: "server02.example.com"

What can cause this problem?

PHP script:

<?php
error_reporting(-1);
ini_set('display_errors', 1);

if (!function_exists('deleteSession')) {
    function deleteSession($targetSessionID)
    {
        // 1. commit session if it's started.
        if (session_id()) {
            session_commit();
        }

        // 2. store current session id
        session_start();
        $current_session_id = session_id();
        session_commit();

        // 3. hijack then destroy session specified.
        
        session_id($targetSessionID);
        session_start();
        session_destroy();
        session_commit();


        // 4. restore current session id. If don't restore it, your current session will refer to the session you just destroyed!
        
        session_id($current_session_id);
        session_start();
        session_commit();

    }
}

$sessions = [
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj',
    'soadjasjosldjsaoidjasoijdsajdsaj'
];

foreach ($sessions as $session) {
    deleteSession($session);
}
Score:1
in flag

I assume that your Nginx is running as a proxy server, sending requests to Apache (upstream here), which is sending a bigger HTTP header than what Nginx is configured to read and therefore exceeded the buffer size set in Nginx configuration. Try increasing the buffer size proxy_buffer_size to a bigger value and restart Nginx server.

Here's a good resource to tune your Nginx proxy configuration which you consider having a look.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.