Skip to content

Commit 9923d43

Browse files
Add support for SSI in error pages
Adds support for Server Side Includes in the error pages. This will allow consumers to create more advanced error pages, including a GovUK-branded one for our own purposes. Replaces the /50x.html location with a more flexible /nginx-proxy/ location, allowing a variety of error pages to be supported and allowing consumers to add whatever extra static assets they wish. * Adds a blank error page for NAXSI rejected requests * Adds support for accessing NAXSI's debug headers **Note:** This is a breaking change.
1 parent e6148b0 commit 9923d43

File tree

8 files changed

+49
-5
lines changed

8 files changed

+49
-5
lines changed

Dockerfile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ ADD ./go.sh /
3131
ADD ./enable_location.sh /
3232
ADD ./location_template.conf /
3333
ADD ./logging.conf /usr/local/openresty/nginx/conf/
34+
ADD ./html/ /usr/local/openresty/nginx/html/
3435
ADD ./readyness.sh /
3536
ADD ./helper.sh /
3637
ADD ./refresh_GeoIP.sh /

ci-build.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ start_test "Test GEODB settings can reject..." "${STD_CMD} \
108108
-e \"ENABLE_UUID_PARAM=FALSE\" \
109109
-e \"ALLOW_COUNTRY_CSV=CG\" \
110110
-e \"DENY_COUNTRY_ON=TRUE\" \
111-
-e \"ADD_NGINX_LOCATION_CFG=error_page 403 /50x.html;\" \
111+
-e \"ADD_NGINX_LOCATION_CFG=error_page 403 /nginx-proxy/50x.shtml;\" \
112112
--link mockserver:mockserver "
113113
echo "Test GeoIP config IS rejected..."
114114
if ! curl -v -k https://${DOCKER_HOST_NAME}:${PORT}/ 2>&1 \

enable_location.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ location ${LOCATION} {
183183
${BASIC_AUTH_CONFIG}
184184
${DENY_COUNTRY}
185185
186-
error_page ${ERROR_REDIRECT_CODES} /50x.html;
186+
error_page ${ERROR_REDIRECT_CODES} /nginx-proxy/50x.shtml;
187187
188188
set \$proxy_address "${PROXY_SERVICE_HOST}:${PROXY_SERVICE_PORT}";
189189

go.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ else
4444
listen ${HTTP_LISTEN_PORT} ;
4545
listen ${HTTPS_LISTEN_PORT} ssl;
4646
set \$real_client_ip_if_set '';
47+
set \$http_listen_port '${HTTP_LISTEN_PORT}';
48+
set \$https_listen_port '${HTTPS_LISTEN_PORT}';
4749
EOF-LISTEN
4850
fi
4951

html/404.shtml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<html>
2+
<head><title>404 Not Found</title></head>
3+
<body bgcolor="white">
4+
<center><h1>404 Not Found</h1></center>
5+
<hr><center>nginx</center>
6+
</body>
7+
</html>

html/418-request-denied.shtml

Whitespace-only changes.

html/50x.shtml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<title>Error</title>
5+
<style>
6+
body {
7+
width: 35em;
8+
margin: 0 auto;
9+
font-family: Tahoma, Verdana, Arial, sans-serif;
10+
}
11+
</style>
12+
</head>
13+
<body>
14+
<h1>An error occurred</h1>
15+
<p>Sorry, the page you are looking for is currently unavailable.<br/>
16+
Please try again later.</p>
17+
<p>If you are the system administrator of this resource then you should check
18+
the <a href="http://nginx.org/r/error_log">error log</a> for details.</p>
19+
<p><em>Faithfully yours, nginx.</em></p>
20+
</body>
21+
</html>

nginx.conf

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@ http {
7979
include /usr/local/openresty/nginx/conf/upload_size*.conf;
8080
include /usr/local/openresty/nginx/conf/nginx_http_extras*.conf;
8181

82+
# Accept underscores in headers as NAXSI does this
83+
underscores_in_headers on;
84+
8285
server {
8386
include /usr/local/openresty/nginx/conf/nginx_statsd_metrics.conf;
8487
include /usr/local/openresty/nginx/conf/response_body.conf;
@@ -112,10 +115,11 @@ http {
112115
# Generate a unique ID for use in logs for passing onto applications
113116
set_by_lua_file $uuidopt /usr/local/openresty/nginx/lua/set_uuid.lua;
114117

115-
location /50x.html {
116-
root /usr/local/openresty/nginx/html;
118+
location /nginx-proxy/ {
119+
alias /usr/local/openresty/nginx/html/;
120+
ssi on;
121+
error_page 404 /nginx-proxy/404.shtml;
117122
allow all;
118-
internal;
119123
}
120124

121125
location /nginx_status {
@@ -127,6 +131,15 @@ http {
127131
}
128132

129133
location /RequestDenied {
134+
# Proxy to ourselves in order to access NAXSI debugging headers
135+
proxy_pass https://127.0.0.1:$https_listen_port/nginx-proxy/RequestDenied;
136+
internal;
137+
}
138+
139+
location /nginx-proxy/RequestDenied {
140+
# Debug information now available in headers ($http_x_naxsi_sig etc.)
141+
# Return a 418 (Teapot) status
142+
error_page 418 /nginx-proxy/418-request-denied.shtml;
130143
return 418;
131144
}
132145

0 commit comments

Comments
 (0)