Draft CIS Benchmark 1.1.2
Description
Define custom error page to reduce system sensitive information.
Rationale
When there is error response such as 404 file not found error, the error message page may reveal NginX version or additional system sensitive information. Hackers may use these information to attack the web service.
Remediation
To define error pages in NginX.conf: server { error\_page 500 501 /50x.html; location = /50x.html { root html } 4xx Error page example server { error\_page 400 401 402 403 404 405 406 407 413 414 /4xx.html; location = /4xx.html{ root html; }
Audit
TBD
Notes
The self-defined error message page must exceed 512 bytes. Otherwise, IE will automatically present its friendly error page instead. For 302 code, it must not define a error message page. Otherwise, all the error will redirect to it. is defined based on current web root directory. Admin may define it based on real situation.
Description
Define custom error page to reduce system sensitive information.
Rationale
When there is error response such as 404 file not found error, the error message page may reveal NginX version or additional system sensitive information. Hackers may use these information to attack the web service.
Remediation
To define error pages in NginX.conf:
server { error\_page 500 501 /50x.html; location = /50x.html { root html }4xx Error page example server { error\_page 400 401 402 403 404 405 406 407 413 414 /4xx.html; location = /4xx.html{ root html; }Audit
TBD
Notes
The self-defined error message page must exceed 512 bytes. Otherwise, IE will automatically present its friendly error page instead. For 302 code, it must not define a error message page. Otherwise, all the error will redirect to it. is defined based on current web root directory. Admin may define it based on real situation.