Re: Aborting malicious requests

On Tue, 20 Mar 2018 13:03:09 + "Friscia, Michael" wrote: > This is great, thank you again, this is a huge jumpstart! Per NIST best practices, you should limit the HTML verbs that you allow. A very simple website can run on just GET and HEAD. Here is how you 444 websites trying to POST for ex

[PATCH] Send Connection: close for draining.

Howdy, First off sorry if the C code is a bit ugly, been a while since I did some C with nginx. So I've some very long running keep-alive connections that although keepalive_timeout helps it is just "not enough" or "fast enough" when I need it to stop draining connections. I looked at the headers

Re: [nginx-announce] nginx-1.13.10

Hello Nginx users, Now available: Nginx 1.13.10 for Windows https://kevinworthington.com/nginxwin11310 (32-bit and 64-bit versions) These versions are to support legacy users who are already using Cygwin based builds of Nginx. Officially supported native Windows binaries are at nginx.org. Annou

Re: nginx erroneously reports period character as illegal in request headers

To clarify, by 'illegal' I meant non-compliant. These headers _are_ used, as we have run into them in production in our business coming from clients, and some time on stack overflow shows these are becoming more and more common. They are also RFC-compliant, and competing products support them. Po

nginx-1.13.10

Changes with nginx 1.13.10 20 Mar 2018 *) Feature: the "set" parameter of the "include" SSI directive now allows writing arbitrary responses to a variable; the "subrequest_output_buffer_size" directive defines maximum response size.

Re: Aborting malicious requests

This is great, thank you again, this is a huge jumpstart! ___ Michael Friscia Office of Communications Yale School of Medicine (203) 737-7932 - office (203) 931-5381 - mobile http://web.yale.edu On 3/19/18, 1:43 PM, "nginx on behalf

Re: nginx erroneously reports period character as illegal in request headers

Hello! On Mon, Mar 19, 2018 at 07:05:43PM -0400, mblancett wrote: > Nginx is reporting invalid incoming headers with RFC-compliant headers that > use a '.' (meaning, a period) within the name. Yes. Because, while being RFC-complaint, these headers cause various problems, some are listed here: