如何拒绝具有特定 url 编码字符的请求？

Question

I'm having problems with a site being exploited, and I have tried many ways to solve this, but I'm missing some skills to get it done.

The issue is I need to deny POST requests to "/%21/Form/create" while accepting POST requests to "/./Form/create".

I have tried:

location = /%21/Form/create {
deny all;
}

location ~ ^/%21.*/ {
deny all;
}

without any luck. I would really appreciate some help solving this.

Answer 1

They are the same URL - but if your server is receiving both forms of request - and you need to differentiate between them - you can use $request_uri to view the request as it was originally received.

The variable can be tested using an if block.

if ($request_uri = /%21/Form/create) { return 403; }