# nginx/gixy

> Checks every nginx file for mistakes that expose a server: request forgery, path traversal through alias, header injection, and a disclosed version.

Checks every nginx file for mistakes that expose a server: request forgery, path traversal through alias, header injection, and a disclosed version.

Part of the [`nginx`](/reference/configurations/nginx/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), per file. It runs gixy.

## Why

These mistakes parse, serve traffic, and look like any other location block until somebody uses them.

## What to do

Change the block the way the rule page says. Turn one rule off with `gspot ignore nginx/gixy --rule <name> --reason "<why>"`.

## Example

A location for `/proxy/(.*)` with `proxy_pass http://$1` sends requests to any host and reports `ssrf`. Point `proxy_pass` at a fixed upstream instead.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore nginx/gixy --paths "<glob>" --reason "<why>"
gspot ignore nginx/gixy --rule <rule> --reason "<why>"
```