nginx does not assign a general specificity score to every location expression. Ordinary prefixes are selected by matching length, exact locations can finish the search, and competing regex locations are evaluated in declaration order. A regex that looks narrower to a human can lose to a broader expression placed earlier. Mixing these selection rules is a common reason apparently careful routing changes affect unexpected paths. ...
Clickjacking deceives a user about which interface receives an action. A hostile parent can place a framed application behind a misleading visual layer so that a click reaches a real control in that application. The parent need not read the child’s DOM for the user to interact with it. Same-origin read restrictions therefore do not replace a decision about whether the application may be embedded at all. ...
Server-side request forgery makes a server issue a request selected or influenced by an attacker. A thumbnail service, importer, webhook tester, or document renderer may reach destinations that the requesting user cannot reach directly. The server contributes its network position and whatever credentials that particular fetch path actually attaches. A URL fetch does not automatically inherit every account credential available to the process. ...
Browsers can attach session cookies to attacker-triggered requests. CSRF defenses distinguish authorized request contexts; they do not prove that a person saw or intended an action. This shows the article’s server fixture, not a browser test. SameSite reduces cookie delivery; trusted request context does not prove human intent. XSS and authentication require separate defenses. Cookies travel without asking Browsers attach cookies to a request according to domain, path, Secure, SameSite, and other browser rules, not on whether the page causing the request was the user’s earlier intent. That means a page on an attacker’s origin can make the victim’s browser send a state-changing request — a transfer, a password change — that carries the authenticated session cookie, and the server sees a request that looks like it came from the legitimate user. This is why a request’s mere presence of credentials is not evidence of the user’s intent; the browser is following the cookie rules, not the user’s choice. ...
gzip is a response content coding: nginx can send a compressed representation that an accepting client decodes. Enabling it requires gzip on; gzip_types extends the eligible MIME types but does not activate compression by itself. The result depends on the response, request capabilities, and effective configuration. A smaller body is useful only if it still decodes to the intended content. ...
A request-rate limit applies to the identity expressed by its key, not automatically to a person, account, or endpoint. limit_req_zone stores shared state for those key values, and limit_req applies the zone while handling a request. Two locations using the same zone and key can consume the same budget. Choosing a variable therefore defines a real fairness and enforcement boundary. ...
A reverse proxy accepts a client connection and makes a separate request to an upstream application. The application’s socket peer is therefore the proxy, while information about an earlier client can arrive through request headers. Those headers are useful only when the deployment defines who may set them and how they are validated. Proxying a request does not automatically make every forwarded identity or scheme claim trustworthy. ...
nginx location matching uses a normalized URI path rather than the untouched request-target text. Percent-encoded characters are decoded, relative path components are resolved, and adjacent slashes can be merged according to configuration. Later processing can change the current URI again and trigger another location search. Understanding both transformations is necessary when a request appears to enter a different handler than its original spelling suggests. ...