Security Introduction

In this lesson, we’ll focus on securing your web applications end-to-end. You’ll learn how to:

1. Enable HTTPS using TLS certificates
2. Understand TLS protocols and data encryption
3. Implement secure HTTP response headers
4. Protect resources with Nginx Basic Authentication
5. Control access and integrate fail2ban for automated bans

1. Enabling HTTPS with Self-Signed Certificates

To get HTTPS running locally, we’ll use mkcert for generating a trusted, self-signed certificate without needing a public domain.

# Install mkcert (macOS example)
brew install mkcert nss

# Create a local CA
mkcert -install

# Generate a cert for localhost
mkcert localhost 127.0.0.1 ::1

# You’ll get files: localhost.pem (cert) and localhost-key.pem (key)

Next, configure Nginx to use these files:

server {
    listen       443 ssl;
    server_name  localhost;

    ssl_certificate     /path/to/localhost.pem;
    ssl_certificate_key /path/to/localhost-key.pem;

    location / {
        root   html;
        index  index.html index.htm;
    }
}

2. How TLS Protects Data in Transit

TLS ensures data integrity and confidentiality with:

3. Secure HTTP Response Headers

Adding HTTP headers can mitigate common web attacks. Configure these in your Nginx server block:

add_header Content-Security-Policy "default-src 'self';" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;

4. Protecting Endpoints with Basic Authentication

Nginx’s auth_basic module offers a simple user/password prompt for selected locations.

# Install apache2-utils for htpasswd
sudo apt-get install apache2-utils

# Create credentials file
htpasswd -c /etc/nginx/.htpasswd user1

server {
    listen 80;
    server_name example.com;

    location /secure {
        auth_basic           "Restricted Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

5. Allowing, Denying, and Automating Bans with fail2ban

Control access with allow and deny directives, then integrate fail2ban to automatically block repeated offenders:

server {
    listen 80;
    server_name example.com;

    # Allow only internal network
    allow 10.0.0.0/24;
    deny all;

    location / {
        try_files $uri $uri/ =404;
    }
}

Finally, configure fail2ban’s Nginx filter and jail:

# /etc/fail2ban/jail.local
[nginx-http-auth]
enabled = true
filter  = nginx-http-auth
port    = http,https
logpath = /var/log/nginx/*error*.log
maxretry = 3

Let’s get started with HTTPS configuration in the next section.

Links and References

• mkcert GitHub Repository
• Let’s Encrypt
• Certbot — EFF
• Nginx Documentation
• fail2ban Official Site