Nginx Subdomain accessible on subdomain its not configured for

问题

I have my staging config setup like so:

server {
listen   80;
server_name staging.domain.com;
root    /var/www/staging/public;

and my production config setup like this:

server {
listen   80;
server_name www.domain.com;
root    /var/www/production/public;

With no other redirects or anything.

The issue is that even if I disable the production config I can still access the staging server at www.domain.com.

Why is it not being restricted to its configured subdomain?

回答1:

I've answered a similar question like this before

Let me start with a small explanation on how nginx matches the hosts, quoting from how nginx processes a request

In this configuration nginx tests only the request’s header field “Host” to determine which server the request should be routed to. If its value does not match any server name, or the request does not contain this header field at all, then nginx will route the request to the default server for this port.

When you disable the main server you only have 1 left, so nginx passes the request to it, if you want to avoid that you need to add a main server to block all unconfigured domains

server {
  listen 80 default_server;
  return 403;
}

Then run

sudo service nginx reload

Then you're set

来源：https://stackoverflow.com/questions/21234600/nginx-subdomain-accessible-on-subdomain-its-not-configured-for