Ziel

WebSocket/HTTP Origins whitelisten ohne Chaos.

Sichere Defaults

• Deny‑by‑default
• Least privilege
• Explizite Allow‑Listen statt Wildcards

Snippet (Copy/Paste)

# /etc/nginx/conf.d/origin-map.conf
map $http_origin $origin_allowed {
  default 0;
  "~^https://(www.)?deine-domain.com$" 1;
}

server {
  # ...
  location /ws {
    if ($origin_allowed = 0) { return 403; }
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_pass http://upstream_ws;
  }
}

Implementierung

• Ziel definieren: Was soll diese Konfiguration erreichen? (Nginx: Origin Whitelist via map)
• Sichere Defaults setzen (deny-by-default, least privilege).
• Konfig anwenden + Reload/Deploy.
• Verifizieren (curl/healthcheck/logs) + Re-Check.
• Dokumentieren: Warum, wie, rollback.

Verifikation

curl -I https://deine-domain.tld
curl -sS https://deine-domain.tld/health || true