The nginx misconfigurations that fail silently

Many misconfigurations of nginx go unnoticed because they appear to function correctly. However, there are specific issues that can silently fail. nginx-gny is a static analyzer for nginx configurations, and a significant portion of its checks are designed to catch these silent failures. Here are four important issues to be aware of:

1. OCSP stapling failure: When OCSP stapling is enabled, nginx fetches certificate revocation status from the CA and attaches it to the handshake. To enable this, nginx requires a local resolver configured in the config file. If no resolver is defined, OCSP stapling will not work as intended. To verify if OCSP stapling is working, use the provided OpenSSL command to check the response status.

Note that Let's Encrypt stopped serving OCSP in August 2025, so if you have a certificate from them, you should remove ssl_stapling instead of adding a resolver.

2. Overly permissive access rules: The ngx_http_access_module checks rules in order and stops at the first match. If none of the rules match, access is granted. An allow list that only allows certain IP ranges can unintentionally grant access to anyone not specified in the list. To avoid this, add a deny all; rule after the allow rules. Additionally, access rules are inherited from an outer context only if the inner context does not define its own rules, which can lead to unintended public access.

3. Incorrect return statement: Placing a return statement before access rules in a location block will terminate the request immediately, preventing access rules from being evaluated. This can result in a 200 OK response being sent to all clients, regardless of their access permissions. To resolve this issue, move the return statement inside the try_files directive, which runs in a later phase of the request processing. This ensures the access rules are evaluated before the return statement is executed.

4. QUIC connection instability: When using QUIC connections with nginx, enabling quic_bpf on and using a reuseport socket can cause connections to be dropped on every reload. This happens because nginx attaches an eBPF program to the socket group, which tracks connection IDs and routes packets to the correct worker. After a reload, nginx starts fresh workers while the old ones are closed, leaving stale entries in the BPF socket map.

Packets for live connections are directed to non-existent workers, causing connections to fail. To fix this issue, disable quic_bpf using the command "quic_bpf off;". This will stop the connections from being dropped, although you will lose optimal connection-migration routing.