diff --git a/docker/nginx/dist/conf/tpotweb.conf b/docker/nginx/dist/conf/tpotweb.conf index 68065cba..24e346ab 100644 --- a/docker/nginx/dist/conf/tpotweb.conf +++ b/docker/nginx/dist/conf/tpotweb.conf @@ -46,7 +46,14 @@ server { client_body_buffer_size 128k; client_header_buffer_size 1k; client_max_body_size 2M; - large_client_header_buffers 2 1k; + + ### Changed from OWASP recommendations: "2 1k" to "2 1280" (So 1.2k) + ### When you pass though potentially another reverse proxy/load balancer + ### in front of tpotce you can introduce more headers than normal and + ### therefore you can exceed the allowed header buffer of 1k. + ### An 280 extra bytes seems to be working for most use-cases. + ### And still keeping it close to OWASP's recommendation. + large_client_header_buffers 2 1280; ### Mitigate Slow HHTP DoS Attack ### Timeouts definition ##