Lab 11: hardened nginx + WAF sidecar

[alberto-de-swerto]

What I did

• Task 1: hardened Nginx with HTTP-to-HTTPS redirect, TLS 1.3 only, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and CSP report-only.
• Task 2: added login rate limiting, connection limits, fail-closed timeouts, TLS session hardening, X25519, cert-rotation runbook, and OCSP-stapling notes.
• Bonus: added a ModSecurity v3 / OWASP CRS 4.28.0 WAF sidecar on https://localhost:8443 and documented a SQLi payload blocked with rule 942100.

Notes

• ssl_protocols TLSv1.3 is enforced. This Nginx image rejects TLS 1.3 suite names inside ssl_ciphers, so TLS 1.3 suites are pinned with ssl_conf_command Ciphersuites while ssl_ciphers stays as a legacy-safe inert list.
• Baseline Nginx passed the SQLi probe to Juice Shop (500 from the app); the WAF returned 403 and wrote the CRS audit entry.
• Only Lab 11 files are committed.

Checklist

• Task 1 — TLS 1.3 + 6 security headers (with proof)
• Task 2 — Rate limit + timeouts + cipher hardening + cert-rotation runbook
• Bonus — ModSecurity WAF + OWASP CRS catching a payload Nginx-alone passes