Update nginx.conf (#3318)

* Update nginx config to filter ReDoS attempts on the login endpoint.

Author: jkppr

contrib/nginx.conf

@@ -8,6 +8,20 @@ http {
         listen [::]:80;
         client_max_body_size 0m;
         location / {
+            # Unauthenticated ReDoS prevention
+            set $redos_check "";
+            if ($request_uri ~* "(/login)"){
+              set $redos_check U;
+            }
+            if ($request_method = POST){
+              set $redos_check "${redos_check}M";
+            }
+            if ($http_content_type != "application/x-www-form-urlencoded"){
+              set $redos_check "${redos_check}CT";
+            }
+            if ($redos_check = UMCT){
+              return 403;
+            }
             proxy_buffer_size 128k;
             proxy_buffers 4 256k;
             proxy_busy_buffers_size 256k;
@@ -18,6 +32,20 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
         location /legacy/ {
+            # Unauthenticated ReDoS prevention
+            set $redos_check "";
+            if ($request_uri ~* "(/login)"){
+              set $redos_check U;
+            }
+            if ($request_method = POST){
+              set $redos_check "${redos_check}M";
+            }
+            if ($http_content_type != "application/x-www-form-urlencoded"){
+              set $redos_check "${redos_check}CT";
+            }
+            if ($redos_check = UMCT){
+              return 403;
+            }
             proxy_buffer_size 128k;
             proxy_buffers 4 256k;
             proxy_busy_buffers_size 256k;