Our security team ran a web-inspect security scan on our site and asked us to disable verb tunneling using headers or query parameters such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to prevent attackers from using an override method to use restricted HTTP methods. Is there a way in nginx configurations where we can disable this verb tunneling ?

  • Is your nginx server reverse proxying the content? If so, you can override headers during the proxy process as described here: stackoverflow.com/questions/44536548/… – Stephen Ostermiller Dec 7 '17 at 9:40
  • I think it is likely your web application that supports these action overrides rather than nginx itself. What web-app are you using? – Stephen Ostermiller Dec 7 '17 at 9:41
  • Thanks for responding @StephenOstermiller . Will look into modifying headers while reverse proxying the content. Our upstream servers are with fastcgi_pass (php-fpm servers). Web application is Drupal 7. – Sriram Dec 8 '17 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.