feat(lab11): hardened nginx + WAF sidecar

[Maflock]

Goal

Put a hardened Nginx reverse proxy in front of Juice Shop (TLS 1.3, full security-header set, rate limiting), document the production posture, and (bonus) drop a Coraza WAF + OWASP CRS sidecar in front of Nginx that catches a real attack pattern.

Changes

• Added submissions/lab11.md
• Changed labs/lab11/reverse-proxy/nginx.conf
• Added labs/lab11/waf/docker-compose.override.yml

Testing

# 1. Verify HTTPS redirect from port 8080
curl -sI http://localhost:8080
# Found: HTTP 308 redirect to https://localhost:8443/ — HTTP requests are forced to HTTPS


# 2. Verify TLS 1.3 negotiation and cipher suite
echo | openssl s_client -connect localhost:8443 -tls1_3 -brief 2>&1 | head -8
# Found: Protocol version TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 — modern encryption enforced


# 3. Verify all 6 security headers present on HTTPS response
curl -skI https://localhost:8443 | grep -E "strict-transport|content-type-options|frame-options|referrer-policy|permissions-policy|content-security"
# Found: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CSP-Report-Only — all 6 headers returned


# 4. Verify rate limiting on login endpoint (10 req/min, burst 5)
seq 1 60 | xargs -n1 -P 30 -I{} curl -sk -o /dev/null -w "%{http_code}\n" https://localhost:8443/rest/user/login 2>/dev/null | sort | uniq -c
# Found: 54 requests returned HTTP 429 (rate limited), 6 returned HTTP 500 — rate limiting enforced, brute-force attacks blocked


# 5. Verify WAF blocks SQL injection that Nginx alone passes
curl -sk -o /dev/null -w "no-waf: %{http_code}\n" "https://localhost:8443/rest/products/search?q='%20OR%201=1--" && \
curl -sk -o /dev/null -w "with-waf: %{http_code}\n" "https://localhost:9443/rest/products/search?q='%20OR%201=1--"
# Found: no-waf returns HTTP 500 (attack reaches app), with-waf returns HTTP 403 (ModSecurity blocks attack)


# 6. Verify WAF audit log captures rule ID and attack details
docker compose logs waf | grep "942100"
# Found: Rule 942100 fired — "SQL Injection Attack Detected via libinjection" at paranoia level 1

---

Artifacts & Screenshots

• submissions/lab11.md
• labs/lab11/reverse-proxy/nginx.conf
• labs/lab11/waf/docker-compose.override.yml

Checklist

• Title is clear (feat(lab11): hardened nginx + WAF sidecar)
• No secrets/large temp files committed
• submissions/lab11.md exists
• Task 1 — TLS 1.3 + 6 security headers (with proof)
• Task 2 — Rate limit + timeouts + cipher hardening + cert-rotation runbook
• Bonus — Coraza/ModSec WAF + OWASP CRS catching a payload Nginx-alone passes