rules-nginx

Mismatched trailing slashes between 'location' and 'alias' can cause path traversal vulnerabilities (e.g. allowing access to '../config.php'). Both must either have a trailing slash or not.

RISK: HTTPS server blocks without a Strict-Transport-Security (HSTS) header allow downgrade attacks — a network attacker can strip TLS on the first request. FIX: add 'add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;' and consider submitting to the HSTS preload list.

It's best practice to define the 'root' directive at the 'server' block level rather than exclusively inside 'location' blocks, to prevent requests that don't match any block from falling back to a default, insecure system path.

Nginx reveals its version number by default, which attackers use to find specific exploits. Add 'server_tokens off;' to your configuration.

RISK: ssl_verify_client off means the server does not verify client certificates on an endpoint that may require mutual TLS (mTLS). If this endpoint expects authenticated clients, set ssl_verify_client on (or optional_no_ca during migration) and supply ssl_client_certificate with the trusted CA bundle.

Using $uri or $document_uri in redirects can lead to HTTP Request Smuggling or CRLF injection. Use $request_uri instead, which contains the original, un-decoded request.

RISK: the cipher suite includes broken algorithms (RC4, DES/3DES, MD5, NULL, EXPORT) that allow decryption of recorded traffic or trivial MITM (SWEET32 CVE-2016-2183, RC4 CVE-2013-2566). FIX: use a modern cipher string such as 'ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;' and add ssl_prefer_server_ciphers on.

RISK: SSLv2, SSLv3, TLS 1.0, and TLS 1.1 are cryptographically broken — SSLv3 is vulnerable to POODLE (CVE-2014-3566), TLS 1.0/1.1 to BEAST and numerous padding-oracle attacks. FIX: use only 'ssl_protocols TLSv1.2 TLSv1.3;' in your server block.