🛡️ Security Configuration

Rate Limiting

Rate limiting is like scenic area crowd control — only this many visitors per second, preventing overcrowding.

http {
    # Define rate limiting zones: 10 requests per second per IP
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;

    server {
        listen 80;

        # API endpoint rate limiting
        location /api/ {
            limit_req zone=api_limit burst=20 nodelay;
            proxy_pass http://127.0.0.1:3000;
        }

        # Login endpoint stricter: 1 request per second
        location /api/login {
            limit_req zone=login_limit burst=3 nodelay;
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

📝 Note: 📝 burst=20 nodelay: allows a burst of 20 requests (queue length), nodelay means process immediately without queuing, excess requests get 503.

Access Control

# Only allow specific IPs to access admin panel
location /admin/ {
    allow 192.168.1.0/24;          # Allow internal network
    allow 10.0.0.1;                # Allow specific IP
    deny all;                      # Deny everything else

    proxy_pass http://127.0.0.1:8080/;
}

# HTTP Basic Auth (username/password authentication)
location /secret/ {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;

    root /var/www/html;
}

# Generate password file
sudo apt install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd admin
New password:
Re-type new password:
Adding password for user admin

Security Response Headers

server {
    # Hide Nginx version number (don't reveal your version, reduces attack surface)
    server_tokens off;

    # Prevent clickjacking
    add_header X-Frame-Options "SAMEORIGIN" always;

    # Prevent MIME type sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Note: X-XSS-Protection is deprecated in Chrome 78+, modern security practices recommend CSP only
    # add_header X-XSS-Protection "1; mode=block" always;

    # Content Security Policy
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
}