常见的Nginx等保漏洞及处理方式

最新推荐文章于 2024-05-27 21:06:21 发布

蜗牛_小吴

最新推荐文章于 2024-05-27 21:06:21 发布

阅读量1.8k

点赞数

分类专栏：问题解决办法等保/漏洞修复文章标签： nginx 运维

本文链接：https://blog.csdn.net/qq_70095877/article/details/131816263

版权

问题解决办法同时被 2 个专栏收录

7 篇文章 0 订阅

订阅专栏

等保/漏洞修复

1 篇文章 0 订阅

订阅专栏

1. 常见扫描Web前端服务器 nginx 出现的一些漏洞 :

点击劫持 : X-Frame-Options 未配置
目标X-Content-Type-Options响应头缺失
目标X-XSS_Protection响应头缺失
目标Content-Security-Policy响应头缺失
目标Strict-Transport-Security响应头缺失
目标Referrer-Policy响应头缺失
目标X-Permitted-Cross-Domain-Policies响应头缺失
目标X-Download-Options响应头缺失

2. 处理方式 :

在nginx.conf 配置文件中，增加如下配置内容(我习惯在server里面添加)：


server {
        listen        80;
        server_name  *.demo.com;
        root   "/www/demo";

        location / {
            index index.php index.html error/index.html;
            error_page 404 /error/404.html;   
            include D:/phpstudy_pro/WWW/8100ktc/nginx.htaccess;
            autoindex  off;
        }
        location ~ \.php(.*)$ {
            fastcgi_pass   127.0.0.1:9007;
            fastcgi_index  index.php;
            fastcgi_split_path_info  ^((?U).+\.php)(/?.+)$;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            fastcgi_param  PATH_INFO  $fastcgi_path_info;
            fastcgi_param  PATH_TRANSLATED  $document_root$fastcgi_path_info;
            include        fastcgi_params;
        }
        add_header X-Content-Type-Options nosniff;
        add_header 'Referrer-Policy' 'origin';
        add_header X-Download-Options "noopen" always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header X-Permitted-Cross-Domain-Policies  "master-only";
        add_header X-Frame-Options SAMEORIGIN;
        add_header Content-Security-Policy "default-src 'self' data: *.xxx.com  'unsafe-inline' 'unsafe-eval' mediastream: ";
        add_header X-Content-Type-Options: nosniff;
        add_header X-XSS-Protection "1; mode=block";
        # proxy_hide_header  X-Powered-By;
	}
}