How to Block .git in Apache, Nginx and Cloudflare?

Don’t expose the .git folder, it might include delicate data.

Whenever you initialize and deploy your software by way of Git, a .git folder with the required data. If .git folder is accessible by way of an online server or frontend over the Web, it may well probably leak delicate knowledge.

Even worse, if credentials are saved in a configuration file.

Use these instruments to seek out credentials within the GitHub repository.

In case you’re undecided if in case you have .git wherever in your net functions, you should use a safety vulnerabilities scanner like OpenVAS, Gitjacker, or some other talked about right here.

Gitjacker is extra than simply detecting the .git folder. It downloads your complete folder.

There are a number of methods to cope with this.

You may select to not hold it .git folder on the server or block any request. Blocking the request is fairly simple, and here is how one can obtain it relying on the net server you are utilizing.

Nginx

If you’re utilizing Nginx, you’ll be able to add the next location directive nginx.conf file

location ~ /.git {
  deny all;
}

The above would instruct Nginx to generate 403 as beneath when there’s a request containing .git

Alternatively, you’ll be able to return 404 if you don’t need an attacker to imagine you might have .git on the server.

location ~ /.git {
  return 404;
}

And this is able to return the HTTP standing code as 404 as beneath.

Whichever you select, do not forget to reboot the Nginx after making the configuration change.

service nginx restart

Apache HTTP

Let’s have a look at block .git on the Apache net server. You need to use RedirectMatch or DirectoryMatch to realize this.

Utilizing RedirectMatch might be the simplest. You simply want so as to add the next httpd.conf or .htaccess file.

RedirectMatch 404 /.git

The above would generate 404 when somebody accesses .git, and the next will present 403.

RedirectMatch 403 /.git

Subsequent, let’s attempt utilizing the DirectoryMatch rule by including the next httpd.conf file.

<DirectoryMatch "^/.*/.git/">
  Deny from all
</Directorymatch>

Restart Apache and open the URL, together with .git; it reveals the error 403 Forbidden.

Cloud Flame

That is my favorite. Block the request on the edge!

However as you’ll be able to guess, this solely works in case your website is accelerated over the Cloudflare community.

• Log in to Cloudflare
• Go to the Firewall tab >> Firewall guidelines >> Create a firewall rule

• Enter a rule title – Block GIT
• Choose Discipline – URI
• Operator – incorporates
• Worth – .git
• Select an motion – Block and save

It takes about 1 minute to propagate the rule to all Cloudflare knowledge facilities. As soon as performed, Cloudflare does the remaining.

One factor to notice: whenever you implement the Cloudflare firewall rule to dam, guarantee that the origin just isn’t uncovered. In any other case, an attacker may bypass Cloudflare to entry .git recordsdata.

Conclusion

I hope the above helps you cut back the chance of exposing the .git folder.