feat(lab11): hardened nginx reverse proxy + TLS 1.3 + security headers

[raylduk8]

Goal

Hardened Nginx reverse proxy with TLS 1.3, security headers, rate limiting, and production posture for Juice Shop.

Changes

• nginx.conf: hardened Nginx config with TLS 1.3 only, 6 security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP-Report-Only), rate limiting on /rest/user/login, connection timeouts, HTTP to HTTPS redirect.
• submissions/lab11.md: full lab submission with HTTPS redirect proof, TLS 1.3 verification, security headers check, rate limit test results, cipher hardening, cert rotation runbook, and OCSP stapling explanation.

Testing

curl -sI http://localhost:8081/ | head -3

echo | openssl s_client -connect localhost:8444 -tls1_3 2>&1 | grep "New, TLSv1.3"

curl -skI https://localhost:8444/ | grep -E "strict-transport|x-frame|x-content|referrer|permissions|csp"

seq 1 60 | xargs -n1 -P 30 -I{} curl -sk -o /dev/null -w "%{http_code}\n" https://localhost:8444/rest/user/login 2>/dev/null | sort | uniq -c

curl -sk https://localhost:8444/rest/admin/application-version

Artifacts & Screenshots

• Task 1 — TLS 1.3 + 6 security headers (with proof)
• Task 2 — Rate limit + timeouts + cipher hardening + cert-rotation runbook
• Bonus — Coraza/ModSec WAF + OWASP CRS catching a payload Nginx-alone passes