Pretty neat! I see that you’re using Hunchentoot — are you concerned that it interns HTTP header names in the KEYWORD package? It means that a malicious client can use up all your RAM by submitting requests with random header names.
I have now updated the Nginx configuration to block arbitrary headers coming from the remote client and explicitly pass only a limited set of headers to Hunchentoot. So now I have something like this in the Nginx reverse proxy configuration:
proxy_pass_request_headers off;
proxy_set_header Accept $http_accept;
proxy_set_header Content-Length $http_content_length;
proxy_set_header Content-Type $http_content_type;
proxy_set_header If-Modified-Since $http_if_modified_since;
proxy_set_header Referer $http_referer;
proxy_set_header User-Agent $http_user_agent;
proxy_set_header X-Forwarded-For $remote_addr;
Commit: https://github.com/susam/mathb/commit/0dcedc0
Nginx configuration: https://github.com/susam/mathb/blob/main/etc/nginx/https.mat...