id,summary,reporter,owner,description,type,status,priority,milestone,component,version,resolution,keywords,cc,uname,nginx_version 359,DENY ALL ignored when using unix sockets,Jevgeni Kiski,,"'''HowTo reproduce:''' Lets create a folder in /tmp with a file mkdir /tmp/secure echo 'My secret' > /tmp/secure/secret.txt Then lets create a virtual server that listens to an unix socket: {{{ server { server_name _; listen unix:/var/run/secure.sock; root /tmp/secure; deny all; location / { index index.html; } } }}} Note: I also added '''deny all''' inside '''server''' block in main server configuration we add proxy_pass to our newly created ""secure"" virtual server {{{ location ^~ /secure/ { proxy_pass http://unix:/var/run/secure.sock:/; } }}} reloading configuration and trying to access http://localhost/secure/secret.txt We got contents! How? Deny all did not work '''Expected:''' 403 Forbidden '''Received:''' 200 OK with contents '''Testing same thing but with ports:''' Replacing sockets with ports: {{{ server { server_name _; listen 8080; root /tmp/secure; deny all; location / { index index.html; } } }}} And main server: {{{ location ^~ /secure/ { proxy_pass http://0.0.0.0:8080/; } }}} Reloading configuration and trying to access http://localhost/secure/secret.txt 403 Forbidden. As expected!",enhancement,closed,minor,,nginx-core,1.2.x,fixed,,,Linux server 3.8.0-19-generic #30-Ubuntu SMP Wed May 1 16:35:23 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux,"nginx version: nginx/1.2.6 (Ubuntu) TLS SNI support enabled configure arguments: --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-log-path=/var/log/nginx/access.log --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --with-pcre-jit --with-debug --with-http_addition_module --with-http_dav_module --with-http_geoip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_realip_module --with-http_stub_status_module --with-http_ssl_module --with-http_sub_module --with-http_xslt_module --with-ipv6 --with-sha1=/usr/include/openssl --with-md5=/usr/include/openssl --with-mail --with-mail_ssl_module --add-module=/home/user/nginx-1.2.6/debian/modules/nginx-auth-pam --add-module=/home/user/nginx-1.2.6/debian/modules/nginx-echo --add-module=/home/user/nginx-1.2.6/debian/modules/nginx-upstream-fair --add-module=/home/user/nginx-1.2.6/debian/modules/nginx-dav-ext-module --add-module=/home/user/nginx-1.2.6/debian/modules/nginx-rtmp-module"