Mitigating Httpoxy #835
Merged
Mitigating Httpoxy #835
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Looks good to me 👍 |
|
Looks good to me 👌 |
|
Stellar. Tyvm for the code! |
|
Note that this fix was reverted as part of #862 That seems to be because Nginx recommend overriding the header just for PHP requests (https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi/#connecting-nginx-to-php-fpm) - not a great solution IMO considering there is exactly zero legitimate use for a Upshot is that when people upgrade to 0.7.0 of this library, their mitigation will come undone. |
Slm0n87
pushed a commit
to Slm0n87/puppet-nginx
that referenced
this pull request
Mar 7, 2019
Mitigating Httpoxy
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Should possibly go together with https://github.com/jfryman/puppet-nginx/compare/httpoxy-test
If you guys are already working on a httpoxy fix, just reject this pull request.
Thanks.