Nginx-Sicherheitsinspektor

Analyzing Nginx Configuration for Security Weaknesses

Nginx powers over 30% of the world's web servers, making its configuration a critical attack surface. Default Nginx installations expose server version information, allow directory listing, lack security headers, and use permissive SSL/TLS settings that leave sites vulnerable to downgrade attacks. The Nginx Security Inspector analyzes your server configuration blocks to detect misconfigurations that expose your infrastructure to common attacks — from information disclosure to protocol downgrade and path traversal.

The inspector evaluates SSL/TLS protocol versions and cipher suites, security header presence, server token exposure, rate limiting configuration, proxy security settings, and access control patterns. Each finding includes the specific directive location, severity classification, and a corrected configuration snippet. All analysis happens entirely in your browser — your server configuration never leaves your device.

SSL/TLS Configuration Issues

The inspector detects weak SSL/TLS configurations that enable protocol downgrade attacks:

• SSLv3 / TLS 1.0 / TLS 1.1 enabled: These protocols have known vulnerabilities (POODLE, BEAST) and should be disabled in favor of TLS 1.2 and 1.3
• Weak cipher suites: Export-grade ciphers, RC4, DES, and NULL ciphers are vulnerable to brute force or known-plaintext attacks
• Missing OCSP stapling: Without OCSP stapling, browsers make separate requests to verify certificate validity, adding latency and privacy concerns
• Missing HSTS header: Without Strict-Transport-Security, users can be downgraded to HTTP through SSL stripping attacks

The recommended configuration enables only TLS 1.2+ with strong cipher suites that provide forward secrecy, protecting past session data even if the server's private key is later compromised.

Information Disclosure and Server Hardening

Default Nginx configurations reveal information useful to attackers:

• server_tokens on: Exposes the exact Nginx version in Server response headers and error pages, enabling targeted CVE exploitation
• autoindex on: Directory listing enabled exposes file structure, backup files, and potentially sensitive documents
• Exposed status pages: /nginx_status or /stub_status accessible without authentication reveals connection counts and server load
• Default error pages: Standard Nginx error pages confirm the server software and version
• Exposed .git or .env files: Missing location blocks to deny access to sensitive dot-files

The inspector flags each disclosure vector and provides the specific deny directives needed to close these information leaks.

Rate Limiting and Access Control

Missing rate limiting leaves servers vulnerable to brute force and denial-of-service attacks:

• No rate limiting zones: Without limit_req_zone directives, every endpoint accepts unlimited requests
• Missing connection limits: No limit_conn allows single clients to exhaust server connections
• Open proxy configuration: Misconfigured proxy_pass without proper access controls can turn your server into an open proxy
• Missing client body size limits: Without client_max_body_size, attackers can send arbitrarily large request bodies

Rate limiting should be applied to authentication endpoints, API routes, and file upload paths at minimum, with graduated responses from throttling to temporary bans.

Code Examples

Hardened Nginx Server Block

server {
    listen 443 ssl http2;
    server_name example.com;

    # TLS hardening
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_stapling on;
    ssl_stapling_verify on;

    # Information disclosure prevention
    server_tokens off;
    autoindex off;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    # Rate limiting
    limit_req zone=api burst=20 nodelay;
    client_max_body_size 10m;

    # Block sensitive files
    location ~ /\. { deny all; }
}