Tag Info

New answers tagged

1

These are all 400 (Bad Request) responses. It seems likely that your web server would include some information about what with the request is bad. That could account for much of the size variance. In the case of the zero response size, it seems likely that the connection was closed before the response was sent.


1

Looks like you are encrypting the traffic twice - once over WAN and another time over LAN. Normally, the reverse proxy would be set up as the SSL termination point as it is usually unnecessary to encrypt the traffic over a secure LAN connection. From your Apache configuration, the reverse proxy (Server ALPHA) is connecting to the web server (Server BETA) ...


1

You should only serve very generic error page to the user, as providing more details on error may disclose highly valuable information for malicious attacker. However you need more information for debugging. There are following solutions: Log all error information rather than just responding with it. This is good for production servers as allows to ...


2

It depends on your situation. Your PHP could also handle the lack of database connection in a nice way. But if you have a custom PHP with many possibilities for bugs and problems, go for an HTML page. If you're using a system such as Drupal or WordPress it's best to go with whatever is provided there, possibly adding something such as a module such as ...


3

This really depends on the error being served. For a 404 error, there would be no reason that there are any issues with the server - meaning all the php stuff should be working find. But if you have a 500 there may be an issue with the server, preventing php from running. This really depends on your tolerance for risk.


3

I would say yes, simply because there isn't any need for dynamic error pages. For example: If your database is down or under pressure, it is unlikely that you will want your error pages to be attempting database connections. Likewise, if your server is under pressure, you don't want your error pages to be carrying out any server-side processing. All-in-all, ...


3

the rule to activate in mosecurity can be found in base_rules/modsecurity_crs_21_protocol_anomalies.conf That would block access to the website when accessed through server IP.


2

Here is an .htaccess option for you: RewriteEngine On RewriteCond %{HTTP_HOST} ^10\.0\.11\.101$ [NC] RewriteRule ^(.*)$ http://www.example.com/$1 [R,L] ...to redirect and... RewriteEngine On RewriteCond %{HTTP_HOST} ^10\.0\.11\.101$ [NC] RewriteRule .* - [F,L] ...to block. Obviously, you will need to change the IP address and domain name to suit your ...


0

Easy. Just set something like this within your main configuration or your virtual configuration: <Directory /var/www/path/to/your/web/documents> Order Deny,Allow Deny from all Allow from 127.0.0.1 ::1 Allow from localhost Allow from 192.168 Allow from 10 Satisfy Any </Directory> The <Directory></Directory> statement ...


0

Add this section inside your virtual host directive: <Location /mypathurl> Order deny,allow Deny from all Allow from 192.168.1.10 </Location> Replace your IP above. This should not be used for financial level security, FYI.


1

Request headers can cause the size of responses to vary. For example if the requesting device or browser allows for Gzip encoding they will let your webserver know that they want the content in gzip format which is a lot smaller. Also pages which are dynamically generated can vary in size. In your example you have /api/. Unless if your api is pumping out ...



Top 50 recent answers are included