2

I'm dealing with a minor information disclosure when using nginx with onions. Servervault.com might be better suited for an nginx question, but I'm not sure a lot of those guys understand onions or the importance of anonymity, so I'm coming here first.

http://myonionsite.onion/directory/

With / at the very end does not disclose any server-side info.

http://myonionsite.onion/directory

Without / at the end, returns this address in the URL bar:

http://myonionsite.onion:18080/directory/

18080 being the tor forwarding port. My nginx server is bind to 127.0.0.1 so the website isn't public facing. The http error page (I think it's a 301) doesn't disclose any info beyond that, I don't think -- making this disclosure very minor but still I would like to resolve it.

I played around with rewrites like:

rewrite ^/directory(.*)$ http://myonionsite.onion redirect;

This kinda worked but I found it caused 302 errors with other elements on my site, such as /logo.png -- which I found bizarre and confusing.

What's the proper way to deal with something like this?

Improve this question
6
  • Are you sure this isn't apache? never seen nginx do this. apache definitely does that. – cacahuatl Jun 23 '17 at 9:47
  • Lol, wow. I know you're used to dealing with stupid people asking stupid questions on a daily basis, but that's a little insulting. – user18043 Jun 23 '17 at 9:49
  • I'm using nginx v1.12.0-2 in Arch, apache is not installed. And also the fact that I managed to successfully (but incorrectly?) redirect the /directory requests should be indication enough that I am indeed modifying the nginx.conf and using nginx – user18043 Jun 23 '17 at 9:51
  • Yeah, I can reproduce this in 1.10 nginx and you may have been using nginx to reverse proxy to apache – cacahuatl Jun 23 '17 at 9:57
  • So could this be a bug in nginx? Can you recommend a temporary workaround? – user18043 Jun 23 '17 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.