Türker Yıldırım

nginx

  • A separate hostname is a separate session

    Note2 min read

    An admin panel on the same hostname as the customer site shares a cookie namespace, a rate limit and a cross-site scripting blast radius. A cookie scoped to…

  • An admin surface deserves its own rate limit

    Note2 min read

    A login form is the highest-value endpoint on the site and is usually governed by the same limit as a product page. The proxy caveat is what makes…

  • An admin panel that was a security boundary

    Deep dive10 min read

    /admin on the same hostname, behind a login form. A support engineer with the same session cookie as a customer.

  • client_max_body_size, and the upload that 413s

    Note2 min read

    Four separate limits govern an upload and the error message names only the one that fired, which is usually not the one you changed. The PHP limit failing…

  • Caddy gets a certificate without you configuring one

    Note2 min read

    Automatic certificate management is the default rather than a feature, which removes a category of configuration and a category of outage. The trade is real in both directions:…

  • nginx 1.22 and the HTTP/3 that is still experimental

    Note2 min read

    1.22 is the stable branch for 2022 and QUIC support is in a separate experimental branch, which is not the same as a feature flag. The distinction matters…

  • map is cheaper than an if inside a location

    Note2 min read

    if inside a location is evaluated per request and interacts badly with most other directives; map is a hash lookup evaluated once. The map form is also composable…

  • A stale-while-revalidate header the proxy actually honours

    Note1 min read

    The directive is widely emitted and unevenly honoured, and nginx needs its own configuration rather than reading the response header. proxy_cache_lock is the piece that prevents a stampede…

  • proxy_read_timeout is not fastcgi_read_timeout

    Note2 min read

    A slow endpoint returning a 504 through nginx has three different timeouts that could be responsible, and they are configured by different directives. The distinction between a 502…

  • A rate limit zone in nginx costs one shared memory block

    Note2 min read

    Rate limiting at the web server is cheaper than in the application and protects the endpoints the application never gets to serve. burst without nodelay queues the excess…