我有以下NGINX配置，默认情况下由DigitalOcean的NodeJS镜像创建。我已经修改了这个配置，但仍然是安全扫描工具，在这种情况下，我使用OWASP ZAP，仍然强调这是高风险。配置如下：

server {

    # SSL configuration
    ...
    root /var/www/mywebsite;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;
    server_name mywebsite.com; # managed by Certbot

    location ^~ /assets/ {
        gzip_static on;
        expires 12h;
        add_header Cache-Control public;
    }

    location / {
        try_files $uri /index.html;     
    }
    
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = mywebsite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80 ;
    listen [::]:80 ;
    server_name mywebsite.com;
    return 404; # managed by Certbot

}

我的UI是从React构建的，所以我只是将构建工件放在/var/www/mywebsite中。
突出显示的风险如下：

Cloud Metadata Potentially Exposed
Solution:
Do not trust any user data in NGINX configs. In this case it is probably the use of the $host variable which is set from the 'Host' header and can be controlled by an attacker.
Reference:
https://www.nginx.com/blog/trust-no-one-perils-of-trusting-user-input/

它说了一些关于过度允许的代理是导致这一点，但我仍然不能弄清楚哪一部分，我需要改变。