Security #

In modern web infrastructure, the web server doesn’t just act as a file server or reverse proxy, but also functions as the first line of defense for our application. Before a request is sent to a backend server or database (which require large computational resources), Nginx is in the perfect position to inspect, restrict, or reject malicious requests to protect our entire application ecosystem.

In this section, we’ll learn Nginx security hardening techniques to protect the web server and application from various common threats. Starting from restricting directory access rights using HTTP Basic Authentication, controlling traffic rates with Rate Limiting, filtering access using IP Addresses, fending off slow Denial of Service (DoS) attacks, to enabling modern browser-side Security Headers.

Defense in Depth Concept #

In securing systems, we apply the Defense in Depth principle. Nginx helps us install filters at every layer before requests touch the application:

flowchart TD
    Start("Client Sends a Request") --> IP["1. IP / Country Restriction<br>Block/Allow Network Access"]
    IP --> Rate["2. Rate Limiting<br>Prevent Brute Force & Scraping"]
    Rate --> Auth["3. Basic Auth<br>Internal Directory Protection"]
    Auth --> Hardening["4. DoS Protection & Throttling<br>Limit Connections & Timeouts"]
    Hardening --> Headers["5. Security Headers<br>Browser-Side Protection"]
    Headers --> End("Request Forwarded to the Application")

    classDef default fill:#1e293b,stroke:#3b82f6,stroke-width:2px,color:#f8fafc;
    classDef startEnd fill:#0f172a,stroke:#10b981,stroke-width:2px,color:#f8fafc;
    class Start,End startEnd;

Security Article List #

Here’s the Nginx security hardening material covered in this section:

Topic	Content File	Main Learning Output
Basic Auth	basic-auth.md	Restrict access to administrative folders or internal dashboards using encrypted username and password credentials (htpasswd).
Rate Limiting	rate-limiting.md	Limit request rates per IP to protect sensitive endpoints (like login/search) from scraping and brute force.
IP Restriction	pembatasan-ip.md	Create trusted IP lists (allow) and block suspicious IPs (deny), as well as process real client IPs behind proxies.
DoS Protection	dos-protection.md	Protect the server from running out of connection slots by limiting simultaneous connections (limit_conn) and setting timeouts safely.
Security Headers	header-keamanan.md	Secure users’ browsers from Cross-Site Scripting (XSS) and Clickjacking attacks using modular HTTP Headers.

By mastering this module, we’ll be able to build a solid defense wall at the web server level to filter dirty traffic before it burdens our application server. Let’s start the discussion by understanding Basic Authentication!