News for hackers. Stuff that matters.

A comment on Optionsbleed – HTTP OPTIONS method can leak Apache's server memory. Parent comment

Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by tyingq on Monday September 18, 2017 @11:11AM (#15276588)
One driver is popular software that depends on the .htaccess construct.

WordPress, for example. It can run on other servers, but their own docs call out the issue..."Since Nginx does not have .htaccess-type capability and WordPress cannot automatically modify the server configuration for you, it cannot generate the rewrite rules for you"

[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by pmlnr on Monday September 18, 2017 @11:17AM (#15276654)
... and this is why WP has it's own rewrite engine, which works perfectly with nginx.
[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by tyingq on Monday September 18, 2017 @11:25AM (#15276717)
The quoted text is from their docs, and does not read that way. Some more:

"With Nginx there is no directory-level configuration file like Apache's .htaccess or IIS's web.config files. All configuration has to be done at the server level by an administrator, and WordPress cannot modify the configuration, like it can with Apache or IIS"

[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by pmlnr on Monday September 18, 2017 @11:55AM (#15276971)
https://codex.wordpress.org/Rewrite_API

What you are saying is, on it's own, true. It's also a solved problem for WP.

[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by solnyshok on Monday September 18, 2017 @12:43PM (#15277381)
does it work with all plugins too?
[ Parent | on HN ]
Re:Optionsbleed – HTTP OPTIONS method can leak Apache's serv... by pmlnr on Monday September 18, 2017 @05:58PM (#15280035)
It runs before the plugin hook, so yes, as far as I was able to test it a while ago, it does.
[ Parent | on HN ]