The current default and catchall config in nginx causes domain leak. maybe create a 000-catchall like
server {
listen 80 default_server;
listen [::]:80 default_server;
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
server_tokens off;
ssl_reject_handshake on;
return 444;
}
and also remove the default since no longer needed!?
Reply
·
@Dennis I am not sure if it is what he refers to, but at least myself I've faced a similar situation.
Lets say you configure a domain for a site with multiple tenantes, but the tenant isn’t added yet to Ploi (so there’s no nginx config for it, so anyone accessing that domain will get the default server configuration until you add the tenant - leaking the default/catchall nginx server conf.
Let me know it makes sense.
