Category: NGINX

Pengamanan Situs dengan menggunakan headers pada server Nginx

Leave a comment

Secure Nginx from Clickjacking with X-FRAME-OPTIONS

Clickjacking

https://owasp.org/www-community/attacks/Clickjacking

X-Frame Options

Header add_header X-Frame-Options “SAMEORIGIN”;

Reference: here

Header X-XSS-Protection

When this header is being sent along with a response and the website contains an XSS attack, the browser will see this XSS attack and stop it from loading. This protection knows 3 levels:

  • X-XSS-Protection: 0; Disables the filter entirely.
  • X-XSS-Protection: 1; Enables the filter but only sanitizes the malicious script
  • X-XSS-Protection: 1; mode=block Enables the filter and completely blocks the page

Example: 

add_header X-XSS-Protection "1; mode=block";
atau
add_header X-XSS-Protection "1;";

Reference

https://youtu.be/pV_uX0jDAh4?si=W6gbBjvpvniVDSDB

X-XSS-Protection headers. Protection or vulnerability?

https://webdock.io/en/docs/how-guides/security-guides/how-to-configure-security-headers-in-nginx-and-apache

Moodle Security, NGINX

Nginx config tips

Leave a comment

Membuat semua file txt, git dan md tidak dapat di akses user

Letakkan script ini dalam file config di bagian atas

location ~.(git|txt|md)$ {
deny all;
return 404;
}

Menyembunyikan versi nginx

Pada /etc/nginx/nginx.conf, tambahkan berikut ini:

server_tokens off;

Tambahan konfigurasi yang tidak standard di Nginx

apt-get install nginx-extras

Setelah itu kita bisa menambahkan kode berikut ini di nginx.conf

server_tokens off;
more_set_headers "Server: Molly Percocet";

Blok semua tipye file tapi tidak untuk file tertentu (misalnya dengan file yang di awali dengan  .well-known )

## Disable .htaccess and other hidden files
location ~ /\.(?!well-known).* {
    deny all;
    access_log off;
    log_not_found off;
}
NGINX