P015C

Magento NGINX Hardening (APSB26-73)

Description

This patch applies the NGINX part of Adobe's APSB26-73 fix and hardens the surrounding NGINX configuration for Magento sites. It adds the /media/customer_address/ deny rule called for by APSB26-73, and hoists that along with a set of other important deny rules to the top of each site's included configuration. Because NGINX evaluates them first, no configuration included afterward can override or weaken them.

Impact

There is no persistent downtime expected. The NGINX configuration is validated with nginx -t before NGINX is restarted on the web nodes, which briefly resets connections on each node as it restarts.

Changes

• Drops a hardening config (00-magento-nginx-hardening.conf) at the top of each Magento site's include order, so its deny rules are evaluated first and cannot be overridden by any configuration included after it. These deny rules include the /media/customer_address/ path that is part of APSB26-73.
• Validates the NGINX configuration and restarts NGINX on the web nodes.

If You Accept

The APSB26-73 exposure is closed, and the important deny rules are enforced ahead of the rest of the site configuration and cannot be relaxed by anything loaded afterward.

If You Reject

The APSB26-73 /media/customer_address/ exposure remains, and the other deny rules are not hoisted to the top.