Nginx is one of the most popular web servers due to its lightweight design and high performance. However, if not properly configured, it can be vulnerable to the security flaws listed in the OWASP Top 10. In this article, I walk you through how to protect your Nginx against these threats, step by step. You'll find practical solutions supported by example configurations.
General Security Principles
Before starting any configuration, keep Nginx up to date (version 1.24 or later recommended). Disable unnecessary modules, hide the server signature, and remove default sites. For example, the server_tokens off; directive removes the Nginx version from HTTP headers. Also, delete unnecessary files under /etc/nginx/conf.d/.
Major OWASP Top 10 Threats and Nginx Solutions
1. Injection (A1)
Filter inputs against SQL, NoSQL, or OS command injections. The most effective method at the Nginx level is integrating ModSecurity (OWASP CRS). Additionally, use limit_req to rate limit requests and block brute-force attacks. Example configuration:
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/s; location /login { limit_req zone=login burst=10 nodelay; }
This setting blocks more than 5 requests per second to the /login path.
2. Broken Authentication and Session Management (A2)
HTTPS is mandatory. Disable old protocols in Nginx with ssl_protocols TLSv1.2 TLSv1.3;. Protect session cookies by adding proxy_cookie_flag HttpOnly Secure SameSite=Lax;. Also avoid basic authentication methods; use the auth_request module for OpenID Connect or JWT validation.
3. Sensitive Data Exposure (A3)
Harden SSL/TLS settings: ssl_ciphers HIGH:!aNULL:!MD5; and add the HSTS header: add_header Strict-Transport-Security "max-age=63072000" always;. Also add add_header X-Content-Type-Options nosniff; to prevent MIME type sniffing. To block access to sensitive files (e.g., .env):
location ~ \.(env|git|svn|log)$ { deny all; return 404; }
4. XML External Entities (XXE) (A4)
Although Nginx does not parse XML directly, to block XXE attacks targeting backend applications, enable request buffering with proxy_request_buffering and limit size with client_max_body_size. OWASP CRS rules detect XXE.
5. Broken Access Control (A5)
Restrict sensitive areas using location blocks. Allow only necessary IP addresses:
location /admin { allow 192.168.1.0/24; deny all; }
You can also implement dynamic access control with the map directive.
6. Security Misconfiguration (A6)
Don't use default configurations. Balance performance and security with settings like ssl_session_tickets off; and ssl_buffer_size 4k;. Customize error pages: error_page 404 /custom_404.html;. Also prevent clickjacking with add_header X-Frame-Options SAMEORIGIN;.
7. Cross-Site Scripting (XSS) (A7)
Add a Content Security Policy (CSP) header:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
Other headers: X-XSS-Protection 1; mode=block and Referrer-Policy no-referrer. These settings reduce browser-based XSS attacks.
8. Insecure Deserialization (A8)
While Nginx does not perform deserialization directly, limit request body size going to the backend: client_body_buffer_size 128k;. Also, use proxy_request_buffering off; to disrupt streaming.
9. Using Components with Known Vulnerabilities (A9)
Keep Nginx regularly updated: yum update nginx on CentOS/RHEL, apt upgrade nginx on Ubuntu/Debian. Also disable unused modules during compilation. Follow Nginx's own security bulletins.
10. Insufficient Logging and Monitoring (A10)
Customize the log format to ease attack detection:
log_format detailed '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log detailed;
Use Fail2ban to automatically block suspicious IPs. Also set error_log level to warn.
Additional Measures and Conclusion
Applying the above configurations alone is not enough. I recommend using ModSecurity + OWASP CRS as a Web Application Firewall (WAF). For example, compile Nginx with mod_security or opt for Nginx Plus's built-in WAF. Also perform regular security scans and penetration tests.
Finally, HostingServer.com.tr advises testing these settings carefully in production. Every server is different; fine-tune according to your needs. Remember, security is a process, not a product.