How do such requests go through Nginx?

Question

Nginx

I set up a bunch of Nginx + NodeJS on the server.
Launched. After a while I see strange requests in the logs
. The strangest request of them all:

GET http://37.28.156.211/sprawdza.php 200 2ms - 1.88kb

nginx config

upstream site {
    server localhost:8080;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen       80;
    server_name  site.com;

    location / {
        root   /var/www/site/public;
        index  index.html index.htm;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://site/;
        proxy_redirect off;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

The strange thing is that in the logs in the URL'e the IP address of the nifiga is not my server. And it is strange that he wrote that he gave 1.88kb.
Maybe the problem is not in the nginx config, kick in the right direction.
Also, I'm wondering how to use this thing?)

Answer 1

There is nothing strange, a remote client connected to your IP and sent a string GET 37.28.156.211/sprawdza.php to the socket. Here he could send any URL. And I gave the page to the node, because it, most likely, also does not check the host in requests. It's best to filter by host in nginx. Check that the node does server.listen(8080, '127.0.0.1'); not just server.listen(8080); It’s impossible to exploit such a problem, except for DOSing, this is not very scary, but you need to filter by hosts.