Score:0

NGINX Reverse Proxy - Hide origin information to the destination server

es flag

I have a script that load images from an external server. This script runs on many different websites and what I need is that every click on the image will be proxied so it seems that the click comes from myapp without passing any information of the origin to the external server. The only information I would like to pass are the User IP and the User-Agent

I have no control over the external server, but from their dashboard I can see that many clicks are properly masked, while some pass the origin information and I have no idea why.

Here is my nginx.conf

location /rvsprx {
    proxy_set_header Referer         "https://www.myapp.com";
    proxy_set_header Origin          "https://www.myapp.com";
    proxy_hide_header                Set-Cookie;
    proxy_ignore_headers             Set-Cookie;
    proxy_set_header                 Cookie "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP       $remote_addr;
    #use google as dns
    resolver                         8.8.8.8;
    proxy_pass                       $arg_dest;
}

This is an example of the HTML created by the script on somesite.com

<a href="https://www.myapp.com/rvsprx?dest=https://www.externalserver.com/landing.html">
  <img src="https://www.myapp.com/rvsprx?dest=https://www.externalserver.com/someimage.jpg"
</a>

How can I properly mask the origin? There are other ways to pass information than Referer, Origin and Cookie?

Thanks in advance.

Score:0
ws flag

This should be a comment but its a bit long.

I have a script that load images from an external server

If the script works then why are you trying to replace it with a nginx config that doesn't and is insecure?

without passing any information of the origin to the external server

In web architectures the term "origin" is applied to the server supplying the content. You are applying the term to the HTTP request which makes reading your question rather difficult.

proxy_ignore_headers Set-Cookie;

An HTTP client does not offer Set-Cookie headers in requests.

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

This appears to contradict your stated requirement. As does X-Real-IP.

but from their dashboard I can see that many clicks are properly masked, while some pass the origin information and I have no idea why

Neither do we since you didn't provide any of the data here.

You are aware that the config you have created amounts to an open web proxy which is a exploitable for all sorts of nefarious practices?

es flag
Yes with the term 'origin' I was referring to the origin of the HTTP request, I apologize for the misunderstanding. Are you suggesting me to use the script to mask the website that is making the request? And if so how can I mask the link and the image request?
ws flag
You said you already had a script that did that? How you write a simple proxy script is a different question than what you aked here (should be posted separately) and is off-topic here. Try Stackoverflow.
es flag
Maybe I wasn't clear, but I said that my script (a tiny javascript) load images from an external server and create the HTML provided before, and STOP. What I need is that the requests for getting the images and for the link are masked so it seems that the requests comes from my app. So no, the script don't do that, don't **Hide the origin information to the destination server** (the topic question) and that's why I'm trying to use the reverse proxy.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.