Check https://attackshipsonfi.re/p/exploiting-cors-misconfigurations out

2 years ago · 698f1f377c
parent 8eb1542f64
commit 698f1f377c
1 changed files with 9 additions and 0 deletions
--- a/core/nginx/conf/proxy.conf
+++ b/core/nginx/conf/proxy.conf
@ -16,3 +16,12 @@ proxy_hide_header X-Forwarded-Host;
 proxy_hide_header X-Forwarded-Server;
 proxy_hide_header X-Host;
 proxy_hide_header X-HTTP-Host-Override;
+
+proxy_hide_header X-Original-URL;
+proxy_hide_header X-Rewrite-URL;
+proxy_hide_header X-URL;
+
+proxy_hide_header X-HTTP-Method;
+proxy_hide_header X-HTTP-Method-Override;
+proxy_hide_header X-Method;
+proxy_hide_header X-Method-Override;