Better late than never: 1. correct, if you need to support vanity urls that can be anything, you need to allow all and then deny specific paths, like so: /filter { # to start, deny all requests (we will not handle PUT DELETE TRACE OPTIONS CONNECT PATCH with dispatcher) ...