How To Block Git In Apache Nginx And Cloudflare

When you initialize and deploy your application through Git, it creates a .git folder that contains necessary information. If .git folder is accessible through a webserver or frontend over the Internet, it can potentially leak sensitive data. Worse, if you have credentials stored in some configuration file. If you are not sure if you have .git somewhere on your web applications, you can use a security vulnerability scanner like OpenVAS, Gitjacker, or other mentioned here. Gitjacker is more than detecting the .git directory. It downloads the entire directory.

There are multiple ways to handle this. You may choose not to keep .git folder on the server or block any request. Blocking the request is pretty straightforward, and this is how you can achieve depending on the webserver you use.

Nginx

If you are using Nginx, you can add the following location directive in nginx.conf file The above would instruct Nginx to throw 403 like below whenever there is a request containing .git

Alternatively, you can return 404 if you don’t want an attacker to assume that you have .git on the server. And this would return the HTTP status code as 404 as below.

Whatever you choose, don’t forget to restart the Nginx after making the configuration change.

Apache HTTP

Let’s see how to block .git in the Apache webserver. You can use RedirectMatch or DirectoryMatch to achieve this. Using RedirectMatch is probably the easiest one. You just need to add the following in httpd.conf or .htaccess file. The above would throw 404 when someone accesses .git, and the following will show 403. Next, let’s try using the DirectoryMatch rule by adding the following in httpd.conf file. Restart the Apache and access the URL, including .git; it will show 403 Forbidden error.

Cloudflare

This is my favorite. Block the request at the edge! But, as you can guess, this will only work if your site is accelerated through the Cloudflare network.

Give a rule name – Block GIT Select field – URI Operator – contains Value – .git Choose an action – Block and save

It will take around 1 minute to propagate the rule across all Cloudflare datacenters. Once done, Cloudflare will do the rest.

One thing to note, when implementing the Cloudflare firewall rule to block, you have to ensure the origin is not exposed. Otherwise, an attacker can bypass Cloudflare to access .git files.