Wget is a pretty handy tool that lets users download files from any HTTP\/HTTPS or FTP server. Curl, on the other hand is an amazing tool that helps you build a new request with plethora of protocols such as \u00a0HTTP, HTTPS, FTP, Telnet, SMTP etc. These tools can be used to test protocols or your server configurations, but at the same time they can also be misused by a malicious attacker to exploit any website.<\/p>\n
In order to thwart these malicious attacks, we need to put specific measures in place. \u00a0One such measure is to block all requests from wget and curl. However, there are specific use cases where you require that external\u00a0users can’t use these tools but specific IPs or servers can.<\/p>\n
So the question is how can we achieve this functionality with Nginx?<\/p>\n
One simple way is to block all requests from wget and curl using the sample code given below.<\/p>\n
### Block wget user agent ###\r\nif ($http_user_agent ~* (wget|curl) ) {\r\n return 403;\r\n}<\/pre>\nThis code block will disallow all requests coming from wget or curl.<\/p>\n
In our deployment scenarios, we have some specific servers, which access our website with these tools. Hence, we need a custom solution, where we can\u00a0restrict curl or wget requests from outside network but not from specific servers or IP addresses.<\/p>\n
One simple way of achieving this functionality is using Nginx modules. For our solution, we will be using Map and Geo module and some internal variables defined in them.<\/p>\n
1. Map module<\/strong> is used to set or create variables depending on the value of source variables.<\/p>\nFor example:<\/p>\n
[js]<\/p>\n
map $http_user_agent $disallow {
\n\tdefault 0;
\n\t~*(curl|wget) 1;
\n}<\/p>\n
[\/js]<\/p>\n
In the code shown above, we have\u00a0created a variable named disallow <\/strong> whose value will depend upon the http_user_agent<\/strong> source variable. Now if the user agent is curl or wget, then disallow<\/strong> variable will take value 1 else it will remain\u00a00, which is the default value.
\nReference: ngx_http_map_module
\n<\/a><\/p>\n2. Geo module<\/strong> is used to set the value of variable depending on the value of client IP address.<\/p>\nFor example:<\/p>\n
[js]<\/p>\n
geo $myserver {
\n\tdefault 1;
\n\tx.x.x.x 0;
\n}
\n[\/js]<\/p>\n