feat(lab11): hardened nginx + WAF sidecar with OWASP CRS

[Wilikson173]

Goal

Deliver a hardened production-grade Nginx reverse proxy in front of Juice Shop with TLS 1.3, full security‑header set, rate limiting, fail‑closed timeouts, modern cipher suites, and a ModSecurity WAF sidecar with OWASP CRS that blocks SQL injection attacks.

Changes

• labs/lab11/reverse-proxy/nginx.conf – completely replaced with hardened configuration:
  • HTTP → HTTPS 308 redirect (ports 8080 → 8443)
  • TLS 1.3 only, X25519 ECDH curve, session resumption
  • Security headers: HSTS, X‑Frame‑Options, X‑Content‑Type‑Options, Referrer‑Policy, Permissions‑Policy, CSP‑Report‑Only
  • Rate limiting on /rest/user/login (10r/m, burst 5)
  • Connection limits and timeouts (client_header_timeout 10s, etc.)
• labs/lab11/waf/docker-compose.override.yml – adds a ModSecurity v3 + OWASP CRS sidecar (paranoia level 1) that proxies to Nginx and blocks SQLi probes.
• submissions/lab11.md – complete report with proofs for all tasks (Task 1, Task 2, Bonus).

Testing

# 1. HTTP redirect (308)
curl -sI http://localhost:8080
# Output shows 308 Permanent Redirect to https://localhost:8443/

# 2. TLS 1.3 negotiation
echo | openssl s_client -connect localhost:8443 -tls1_3 -brief 2>&1 | head -8
# Protocol version: TLSv1.3, Ciphersuite: TLS_AES_256_GCM_SHA384

# 3. Security headers
curl -skI https://localhost:8443
# All six headers present (HSTS, X‑Frame‑Options, etc.)

# 4. Rate limit (60 concurrent requests)
seq 1 60 | xargs -n1 -P 10 -I{} curl -sk -o /dev/null -w "%{http_code}\n" \
  https://localhost:8443/rest/user/login 2>/dev/null | sort | uniq -c
# 53 x 429, 7 x 500 (upstream app errors)

# 5. Timeout (client_header_timeout 10s)
(printf "GET / HTTP/1.1\r\nHost: localhost\r\n"; sleep 12) | timeout 15 nc localhost 8080
# Connection closed after ~10s (408 or reset)

# 6. Cipher & curve
echo | openssl s_client -connect localhost:8443 -tls1_3 2>&1 | grep -E "Cipher|Server Temp Key"
# Cipher: TLS_AES_256_GCM_SHA384, Server Temp Key: X25519

# 7. WAF direct (blocks SQLi)
curl -s -o /dev/null -w "WAF direct: %{http_code}\n" \
  "http://localhost:8090/rest/products/search?q='%20OR%201=1--"
# Returns 403 (blocked by CRS rule 942100)

# 8. WAF audit log shows rule 942100 fired
docker logs lab11-waf --tail 50 | grep -A5 -B5 "942100"

##Artifacts & Screenshots
~submissions/lab11.md – complete report with all proofs and explanations.
~labs/lab11/reverse-proxy/nginx.conf – final hardened configuration.
~labs/lab11/waf/docker-compose.override.yml – WAF sidecar definition.
    
##Checklist
- [+] Title follows feat(labN): <topic> style
- [+] No secrets or large temp files committed
- [+] Submission file exists at submissions/lab11.md