My notes on NGINX administration basics, tips & tricks, caveats, and gotchas.
Hi-diddle-diddle, he played on his
fiddle and danced with lady pigs.
Number three said, "Nicks on tricks!
I'll build my house with EN-jin-EKS!".
The Three Little Pigs: Who's Afraid of the Big Bad Wolf?
Before you start playing with NGINX please read an official Beginner’s Guide. It's a great introduction for everyone.
Nginx (/ˌɛndʒɪnˈɛks/ EN-jin-EKS, stylized as NGINX or nginx) is an open source HTTP and reverse proxy server, a mail proxy server, and a generic TCP/UDP proxy server with a strong focus on high concurrency, performance and low memory usage. It is originally written by Igor Sysoev.
For a long time, it has been running on many heavily loaded Russian sites including Yandex, Mail.Ru, VK, and Rambler. At this moment some high-profile companies using NGINX include Cisco, DuckDuckGo, Facebook, GitLab, Google, Twitter, Apple, Intel, and many more. In the September 2019 it was the most commonly used HTTP server (see Netcraft survey).
NGINX is a fast, light-weight and powerful web server that can also be used as a:
So, to be brief, it provides the core of complete web stacks and is designed to help build scalable web applications. When it comes to performance, NGINX can easily handle a huge amount of traffic. The other main advantage of the NGINX is that allows you to do the same thing in different ways.
Unlike traditional HTTP servers, NGINX doesn't rely on threads to handle requests and it was written with a different architecture in mind - one which is much more suitable for nonlinear scalability in both the number of simultaneous connections and requests per second.
NGINX is also known as a Apache Killer (mainly because of its lightness and much less RAM consumption). It is event-based, so it does not follow Apache's style of spawning new processes or threads for each web page request. Generally, it was created to solve the C10K problem.
For me, it is a one of the best and most important service that I used in my SysAdmin career.
These essential documents should be the main source of knowledge for you:
In addition, I would like to recommend three great docs focuses on the concept of the HTTP protocol:
If you love security keep your eye on this one: Cryptology ePrint Archive. It provides access to recent research in cryptology and explores many subjects of security (e.g. Ciphers, Algorithms, SSL/TLS protocols). A great introduction that covers core concepts of cryptography is Practical Cryptography for Developers. I also recommend to read the Bulletproof SSL and TLS. Yep, it's definitely the most comprehensive book about deploying TLS for me.
An obligatory source of knowledge is also the OWASP Cheat Sheet Series. You should ought treat it as an excellent security guidance. Burp Scanner - Issue Definitions introduces you to the web apps and security vulnerabilities. Finally, The Web Security Academy is a free online training center for web application security with high-quality reading materials and interactive labs of varying levels of difficulty. All are really good source to start learning about web application security.
And, of course, always browse official Nginx Security Advisories and CVE databases like CVE Details or CVE - The MITRE Corporation - to stay Up-to-Date on NGINX vulnerabilities.
When I was studying architecture of HTTP servers I became interested in NGINX. As I was going through research, I kept notes. I found a lot of information about it, e.g. forum posts on the web about every conceivable problem was great. However, I've never found one guide that covers the most important things in a suitable form. I was a little disappointed.
I was interested in everything: NGINX internals, functions, security best practices, performance optimisations, tips & tricks, hacks and rules, but for me some of the documents treated the subject lightly.
Of course, NGINX Official Documentation is the best place but I know that we also have other great resources:
These are definitely the best assets for us and in the first place you should seek help there. Moreover, in order to improve your knowledge, please see Books chapter - it contains top literature on NGINX.
Why I created this handbookFor me, however, there hasn't been a truly in-depth and reasonably simple cheatsheet which describe a variety of configurations and important cross-cutting topics for HTTP servers. Configuration of the NGINX can be tricky sometimes and you really need to get into the syntax and concepts to get an understanding tricks, loopholes, and mechanisms. The documentation isn't as pretty as other projects and should certainly include more robust examples.
This handbook is a set of rules and recommendations for the NGINX Open Source HTTP server. It also contains the best practices, notes, and helpers with countless examples. Many of them refer to external resources.
There are a lot of things you can do to improve in your NGINX instance and this guide will attempt to cover as many of them as possible. For the most part, it contains the most important things about NGINX for me. I think the configuration you provided should work without any talisman. That's why I created this repository.
With this handbook you will explore the many features and capabilities of the NGINX. You'll find out, for example, how to testing the performance or how to resolve debugging problems. You will learn configuration guidelines, security design patterns, ways to handle common issues and how to stay out of them. I explained here a few best tips to avoid pitfalls and configuration mistakes.
I added set of guidelines and examples has also been produced to help you administer of the NGINX. They give us insight into NGINX internals also.
Mostly, I apply the rules presented here on the NGINX working as a reverse proxy. However, does not to prevent them being implemented for NGINX as a standalone server.
If you do not have the time to read hundreds of articles (just like me) this multipurpose handbook may be useful. I created it in the hope that it will be useful especially for System Administrators and Experts of Web-based applications.
This handbook does not get into all aspects of NGINX. What's more, some of the things described in this guide may be rather basic because most of us do not configure NGINX every day and it is easy to forget about basic/trivial things. On the other hand, also discusses heavyweight topics so there is something for advanced users. I tried to put external resources in many places in this handbook in order to dispel any suspicion that may exist.
I did my best to make this handbook a single and consistent (but now I know that is really hard). It's organized in an order that makes logical sense to me. I think it can also be a good complement to official documentation and other great documents. Many of the topics described here can certainly be done better or different. Of course, I still have a lot to improve and to do. I hope you enjoy and have fun with it.
Do not treat this handbook and notes written here as revealed knowledge. You should take a scientific approach when reading this document. If you have any doubts and disagree with me, please point out my mistakes. You should to discover cause and effect relationships by asking questions, carefully gathering and examining the evidence, and seeing if all the available information can be combined in to a logical answer.
I create this handbook for one more reason. Rather than starting from scratch in, I putting together a plan for answering your questions to help you find the best way to do things and ensure that you don't repeat my mistakes from the past.
So, what's most important:
Finally, you should know I'm not a NGINX expert but I love to know how stuff works and why work the way they do. I’m not a crypto expert... but I do know the term "elliptic curve" (I really like this quote!). Don't need to be an expert to figure out the reason just got to have used this and not this or why something works this way and not another. It feels good to understand the recommendations and nuances of a topic you’re passionate about.
Remember about the following most important things:
Blindly deploying of the rules described here can damage your web application!
Do not follow guides just to get 100% of something. Think about what you actually do at your server!
Copy-and-paste is not the best way to learn. Think twice before adopting rules from this handbook.
There are no settings that are perfect for everyone.
Always think about what is better and more important for you: security vs usability/compatibility.
Security mainly refers to minimise the risk.
Change one thing may open a whole new set of problems.
Read about how things work and what values are considered secure enough (and for what purposes).
The only correct approach is to understand your exposure, measure and tune.
+ Security is important for ethical reasons. Compliance is important for legal reasons. + The key to workplace contentment is understanding they are unrelated to each other. + Both are important, but one does not lead to the other (compliance != security). author: unknown + Security is always needed, no matter what type of website it is. It can be static HTML + or fully dynamic, an attacker can still inject hostile content into the page in transit + to attack the user. author: Scott Helme + Don’t enable older deprecated protocols just because Karen in Florida is still using + a PC that she bought back in 2001. author: thisinterestsmeblog
I think, in the age of phishing, cyber attacks, ransomware, etc., you should take care of security of your infrastructure as hard as possible but don't ever forget about this one...
Lastly, I would like to quote two very important comments found on the web about compliance with the standards and regulations, and essence of a human factor in security:
Regulations that make sense are often not descriptive - capturing the intent and scope of a rule often requires technical expertise. More than that, it's the type of expertise most organisations do not have. And instead of improving themselves, these companies, who may form the grand majority of the industry, petition the regulators to provide a safe checklist of technical mitigations that can be implemented to remain compliant. [...] Instead of doing the right thing and meeting the planned intent, companies are instead ticking nonsensical boxes that the regulators and their auditors demand. Blindly. Mindlessly. Divorced from reality. - by bostik
Whenever considering security, the human factor is nearly always as important or more important than just the technical aspects. Policy and procedures need to consider the human element and try to ensure that these policies and procedures are structured in such a way as to help enable staff to do the right thing, even when they may not fully understand why they need to do it. - by Tim X
A real community, however, exists only when its members interact in a meaningful way that deepens their understanding of each other and leads to learning.
If you find something which doesn't make sense, or something doesn't seem right, please make a pull request and please add valid and well-reasoned explanations about your changes or comments.
Before adding a pull request, please see the contributing guidelines.
This project exists thanks to all the people who contribute.
What needs to be done? Look at the following ToDo list:
New chapters:
Existing chapters:
IntroductionIf you have any idea, send it back to me or add a pull request.
GitHub exposes an RSS/Atom feed of the commits, which may also be useful if you want to be kept informed about all changes.
Checklist to rule them allThis checklist was the primary aim of the nginx-admins-handbook. It contains a set of best practices and recommendations on how to configure and maintain the NGINX properly.
This checklist contains all rules (79) from this handbook.
Generally, I think that each of these principles is important and should be considered. I separated them into four levels of priority to help guide your decision.
Remember, these are only guidelines. My point of view may be different from yours so if you feel these priority levels do not reflect your configurations commitment to security, performance or whatever else, you should adjust them as you see fit.
RULE CHAPTER PRIORITY Define the listen directives with address:port pairYou can find here a few of the different things I've worked and included to this repository. I hope that these extras will be useful.
Many of these recipes have been applied to the configuration of my old private website.
An example configuration is in the configuration examples chapter. It's also based on this version of printable high-res hardening cheatsheets.
Read about SSL Labs grading here (SSL Labs Grading 2018).
Short SSL Labs grades explanation:
A+ is clearly the desired grade, both A and B grades are acceptable and result in adequate commercial security. The B grade, in particular, may be applied to configurations designed to support very wide audiences (for old clients).
I finally got A+ grade and following scores:
Look also at the following recommendations. I believe the right configuration of NGINX should give the following SSL Labs scores and provides the best security for the most cases:
Recommended
Perfect but restrictive
Something about SSL Labs grading mechanism (that's an interesting point of view):
The whole grading mechanism is more propaganda and public relations than actual security. If you want good security, then you must mind the details and understand how things work internally. If you want a good grade then you should do whatever it takes to have a good grade. An "A+" from SSL Labs is a very nifty thing to add at the end of a report, but it does not really equate with having rock solid security. Having an "A+" equates with being able to say "I have an A+". - from this answer by Tom Leek.
Read about Mozilla Observatory here and about Observatory Scoring Methodology.
I also got the highest summary note (A+) on the Observatory with a very high test score (120/100, max. 135/100):
Printable hardening cheatsheetsI created two versions of printable posters with hardening cheatsheets (High-Res 5000x8800) based on recipes from this handbook:
For
xcfand
A+ with all 100%’s on @ssllabs and 120/100 on @mozilla observatory:
It provides the highest scores of the SSL Labs test. Setup is very restrictive with 4096-bit private key, only TLS 1.2, and also modern strict TLS cipher suites (non 128-bits). Think carefully about its use (no TLS 1.3, restrictive cipher suites), in my opinion, it is only suitable for obtaining the highest possible rating and seems a little impractical.
A+ on @ssllabs and 120/100 on @mozilla observatory with TLS 1.3 support:
It provides less restrictive setup with 2048-bit key for
RSAor 256-bit key forECC, TLS 1.3 and 1.2, modern strict TLS cipher suites (128/256-bits), and 2048-bit predefinedDHgroups recommended by Mozilla. The final grade is also in line with the industry standards and guidance. Recommend using this, for me, it is very reasonable configuration.
I created a set of scripts for unattended installation of NGINX from the raw, uncompiled code. It allows you to easily install, create a setup for dependencies (like zlib or openssl), and customized with installation parameters.
For more information please see Installing from source - Automatic installation chapter which describes the installation of NGINX on systems/distros such as Ubuntu, Debian, CentOS, and FreeBSD.
Static error pages generatorI created a simple to use generator for static pages to replace the default error pages that comes with any web server like NGINX.
For more information please see HTTP Static Error Pages Generator.
I added scripts for fast multiple domain searching in the configuration. These tools get specific server_name matches and print them on the screen as a server { ... } blocks. Both are very helpful if you really have tons of domains or if you want to list specific vhosts from file or the active configuration.
You must follow one important rule to be able to use it. Your server block must have the following structure:
server {
server_name example.com example.org;
... # other directives
}
Example of use:
./snippets/server-name-parser/check-server-name.sh example.com
Searching 'example.com' in '/usr/local/etc/nginx' (from disk)
/usr/local/etc/nginx/domains/example.com/servers.conf:79: return 301 https://example.com$request_uri;
/usr/local/etc/nginx/domains/example.com/servers.conf:252: return 301 https://example.com$request_uri;
/usr/local/etc/nginx/domains/example.com/servers.conf:3825: server_name example.com;
Searching 'example.com' in server contexts (from a running process)
>>>>>>>>>> BEG >>>>>>>>>>
server {
include listen/192.168.252.10/https.example.com.conf;
server_name example.com;
location / {
return 204 "RFC 792";
}
access_log /var/log/nginx/example.com/access.log standard;
error_log /var/log/nginx/example.com/error.log warn;
}
<<<<<<<<<< END <<<<<<<<<<
For more information please see snippets/server-name-parser directory.
Authors: Valery Kholodkov
Excel in Nginx quickly by learning to use its most essential features in real-life applications.
This short review comes from this book or the store.
Authors: Derek DeJonghe
You’ll find recipes for:
This short review comes from this book or the store.
Authors: Martin Fjordvald, Clement Nedelcu
Harness the power of Nginx to make the most of your infrastructure and serve pages faster than ever.
This short review comes from this book or the store.
Authors: Rahul Sharma
Optimize NGINX for high-performance, scalable web applications.
This short review comes from this book or the store.
Authors: Dimitri Aivaliotis
Written for experienced systems administrators and engineers, this book teaches you from scratch how to configure Nginx for any situation. Step-by-step instructions and real-world code snippets clarify even the most complex areas.
This short review comes from this book or the store.
Authors: Faisal Memon, Owen Garrett, Michael Pleshakov
Learn in this ebook how to get started with ModSecurity, the world’s most widely deployed web application firewall (WAF), now available for NGINX and NGINX Plus.
This short review comes from this book or the store.
Authors: Faisal Memon
This ebook provides step-by-step instructions on replacing Cisco ACE with NGINX and off-the-shelf servers. NGINX helps you cut costs and modernize.
In this ebook you will learn:
This short review comes from this book or the store.
:black_small_square: Nginx Project
:black_small_square: Nginx Documentation
:black_small_square: Nginx Wiki
:black_small_square: Nginx Admin's Guide
:black_small_square: Nginx Pitfalls and Common Mistakes
:black_small_square: Development Guide
:black_small_square: Nginx Forum
:black_small_square: Nginx Security Advisories
:black_small_square: Nginx Security Controls
:black_small_square: Nginx Mailing List
:black_small_square: Nginx Read-only Mirror
:black_small_square: NGINX-Demos
:black_small_square: Thread Pools in NGINX Boost Performance 9x!
:black_small_square: OpenResty
:black_small_square: The Tengine Web Server
:black_small_square: NGINX vs. Apache (Pro/Con Review, Uses, & Hosting for Each)
:black_small_square: Web cache server performance benchmark: nuster vs nginx vs varnish vs squid
:black_small_square: agentzh's Nginx Tutorials
:black_small_square: Introduction to nginx.conf scripting
:black_small_square: Nginx discovery journey
:black_small_square: Nginx Guts
:black_small_square: Nginx Cheatsheet
:black_small_square: Nginx Tutorials, Linux Sysadmin Configuration & Optimizing Tips and Tricks
:black_small_square: Nginx boilerplate configs
:black_small_square: Awesome Nginx configuration template
:black_small_square: Nginx Quick Reference
:black_small_square: A collection of resources covering Nginx and more
:black_small_square: A collection of useful Nginx configuration snippets
:black_small_square: Nginx configurations for most popular CMS/CMF/Frameworks based on PHP
:black_small_square: Boilerplate configuration for nginx and certbot with docker-compose
:black_small_square: Nginx Tuning For Best Performance by Denji
:black_small_square: Nginx Optimization: understanding sendfile, tcp_nodelay and tcp_nopush
:black_small_square: How we scaled nginx and saved the world 54 years every day
:black_small_square: TLS has exactly one performance problem: it is not used widely enough
:black_small_square: SSL/TLS Deployment Best Practices
:black_small_square: SSL Server Rating Guide
:black_small_square: SSL Pulse
:black_small_square: How to Build a Tough NGINX Server in 15 Steps
:black_small_square: Top 25 Nginx Web Server Best Security Practices
:black_small_square: Nginx Secure Web Server
:black_small_square: Strong SSL Security on Nginx
:black_small_square: Enable cross-origin resource sharing (CORS)
:black_small_square: NAXSI - WAF for Nginx
:black_small_square: ModSecurity for Nginx
:black_small_square: NGINX: Basics and Best Practices
:black_small_square: NGINX Installation and Tuning
:black_small_square: Nginx Internals (by Joshua Zhu)
:black_small_square: Nginx internals (by Liqiang Xu)
:black_small_square: How to secure your web applications with NGINX
:black_small_square: Tuning TCP and NGINX on EC2
:black_small_square: Extending functionality in nginx, with modules!
:black_small_square: Nginx - Tips and Tricks.
:black_small_square: Nginx Scripting - Extending Nginx Functionalities with Lua
:black_small_square: How to handle over 1,200,000 HTTPS Reqs/Min
:black_small_square: Using ngx_lua / lua-nginx-module in pixiv
:black_small_square: Reading nginx CHANGES together
:black_small_square: Dynamic modules:how it works
:black_small_square: NGINX Conf 2014
:black_small_square: NGINX Conf 2015
:black_small_square: NGINX Conf 2016
:black_small_square: NGINX Conf 2017
:black_small_square: NGINX Conf 2018 | Deep Dive Track
:black_small_square: NGINX Conf 2018 | Keynotes and Sessions
:black_small_square: Making HTTPS Fast(er): Ilya Grigorik @ nginx.conf 2014
:black_small_square: NGINX Rate Limit, Burst and nodelay sandbox
:black_small_square: nginxconfig - Nginx config generator on steroids.
:black_small_square: ssl-config-generator - Mozilla SSL Configuration Generator.
:black_small_square: nginx-config-builder - is a python library for building nginx configuration files programatically.
:black_small_square: crossplane - quick and reliable way to convert NGINX configurations into JSON and back.
:black_small_square: nginxparser - parses nginx configuration with Pyparsing.
:black_small_square: ansible-role-nginx - asible role to install and manage nginx configuration.
:black_small_square: ansible-role-nginx - installs and configures the latest version of Nginx.
:black_small_square: ansible-role-nginx - installs NGINX, NGINX Plus, the NGINX Amplify agent, and more.
:black_small_square: puppet-nginx - puppet module to manage NGINX on various UNIXes.
:black_small_square: gixy - is a tool to analyze Nginx configuration to prevent security misconfiguration and automate flaw detection.
:black_small_square: nginx-config-formatter - Nginx config file formatter/beautifier written in Python.
:black_small_square: nginxbeautifier - format and beautify Nginx config files.
:black_small_square: nginx-minify-conf - creates a minified version of a Nginx configuration.
:black_small_square: GoAccess - is a fast, terminal-based log analyzer (quickly analyze and view web server statistics in real time).
:black_small_square: Graylog - is a leading centralized log management for capturing, storing, and enabling real-time analysis.
:black_small_square: Logstash - is an open source, server-side data processing pipeline.
:black_small_square: ngxtop - parses your Nginx access log and outputs useful, top-like, metrics of your Nginx server.
:black_small_square: Nginx-builder - is a tool for building deb or rpm package NGINX from the source code.
:black_small_square: ab - is a single-threaded command line tool for measuring the performance of HTTP web servers.
:black_small_square: siege - is an http load testing and benchmarking utility.
:black_small_square: wrk - is a modern HTTP benchmarking tool capable of generating significant load.
:black_small_square: wrk2 - is a constant throughput, correct latency recording variant of wrk.
:black_small_square: vegeta - HTTP load testing tool and library.
:black_small_square: bombardier - is a HTTP(S) benchmarking tool.
:black_small_square: gobench - is a HTTP/HTTPS load testing and benchmarking tool.
:black_small_square: hey - is a HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom.
:black_small_square: boom - is a script you can use to quickly smoke-test your web app deployment.
:black_small_square: httperf - the httperf HTTP load generator.
:black_small_square: JMeter™ - is designed to load test functional behavior and measure performance.
:black_small_square: Gatling - is a powerful open-source load and performance testing tool for web applications.
:black_small_square: locust - is an easy-to-use, distributed, user load testing tool.
:black_small_square: slowloris - low bandwidth DoS tool. Slowloris rewrite in Python.
:black_small_square: slowhttptest - application layer DoS attack simulator.
:black_small_square: GoldenEye - GoldenEye Layer 7 (KeepAlive+NoCache) DoS test tool.
:black_small_square: strace - is a diagnostic, debugging and instructional userspace utility (linux syscall tracer) for Linux.
:black_small_square: GDB - allows you to see what is going on `inside' another program while it executes.
:black_small_square: SystemTap - provides infrastructure to simplify the gathering of information about the running Linux system.
:black_small_square: stapxx - simple macro language extensions to SystemTap.
:black_small_square: htrace.sh - is a simple Swiss Army knife for http/https troubleshooting and profiling.
:black_small_square: Burp Suite - is a graphical tool for testing Web application security.
:black_small_square: w3af - is a Web Application Attack and Audit Framework.
:black_small_square: nikto - web server scanner which performs comprehensive tests.
:black_small_square: ssllabs-scan - client for SSL Labs APIs, designed for automated and/or bulk testing.
:black_small_square: http-observatory - Mozilla HTTP Observatory.
:black_small_square: testssl.sh - checks a server's service on any port for the support of TLS/SSL ciphers.
:black_small_square: sslyze - is a fast and powerful SSL/TLS server scanning library.
:black_small_square: cipherscan - is a very simple way to find out which SSL ciphersuites are supported by a target.
:black_small_square: O-Saft - OWASP SSL advanced forensic tool.
:black_small_square: Nghttp2 - is an implementation of HTTP/2 and its header compression algorithm HPACK in C.
:black_small_square: h2spec - is a conformance testing tool for HTTP/2 implementation.
:black_small_square: h2t - is a simple tool to help sysadmins to hardening their websites.
:black_small_square: http2fuzz - HTTP/2 fuzzer written in Golang.
:black_small_square: Arjun - HTTP parameter discovery suite.
:black_small_square: Corsy - CORS misconfiguration scanner.
:black_small_square: XSStrike - most advanced XSS scanner.
:black_small_square: Sample ebook generated from NGINX source code.
:black_small_square: Programming in Lua (first edition)
:black_small_square: Scripting Nginx with Lua
:black_small_square: Emiller’s Guide To Nginx Module Development
:black_small_square: Emiller’s Advanced Topics In Nginx Module Development
:black_small_square: NGINX Tutorial: Developing Modules
:black_small_square: An Introduction To OpenResty (nginx + lua) - Part 1
:black_small_square: An Introduction To OpenResty - Part 2 - Concepts
:black_small_square: An Introduction To OpenResty - Part 3
:black_small_square: OpenResty (Nginx) with dynamically generated certificates
:black_small_square: Programming OpenResty
:black_small_square: SSL Server Test by SSL Labs
:black_small_square: Test SSL/TLS (PCI DSS, HIPAA and NIST)
:black_small_square: SSL analyzer and certificate checker
:black_small_square: Tools for testing SSL configuration
:black_small_square: Test your TLS server configuration (e.g. ciphers)
:black_small_square: Scan your website for non-secure content
:black_small_square: Analyze website security
:black_small_square: TLS Cipher Suite Search
:black_small_square: SSL/TLS Capabilities of Your Browser
:black_small_square: SSL-Client Info's
:black_small_square: Public Diffie-Hellman Parameter Service/Tool
:black_small_square: Analyse the HTTP response headers by Security Headers
:black_small_square: Analyze your website by Mozilla Observatory
:black_small_square: CAA Record Helper
:black_small_square: Linting tool that will help you with your site's accessibility, speed, security and more
:black_small_square: Service to scan and analyse websites
:black_small_square: Tool from above to either encode or decode a string of text
:black_small_square: Online translator for search queries on log data
:black_small_square: Online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript
:black_small_square: Online tool to learn, build, & test Regular Expressions
:black_small_square: Online Regex Tester & Debugger
:black_small_square: Tool for testing regular expressions directly within an NGINX configuration
:black_small_square: A web app for encryption, encoding, compression and data analysis
:black_small_square: Nginx location match tester
:black_small_square: Nginx location match visible
:black_small_square: Web technology for developers
:black_small_square: Mozilla Web Security
:black_small_square: Application Security Wiki
:black_small_square: OWASP ASVS 3.0.1
:black_small_square: OWASP ASVS 3.0.1 Web App
:black_small_square: OWASP ASVS 4.0
:black_small_square: OWASP Top 10 Proactive Controls 2018.
:black_small_square: OWASP Testing Guide v4
:black_small_square: OWASP Dev Guide
:black_small_square: Transport Layer Protection Cheat Sheet by OWASP
:black_small_square: OWASP WSTG
:black_small_square: Security/Server Side TLS by Mozilla
:black_small_square: Applied Crypto Hardening
:black_small_square: Browser support tables for modern web technologies
:black_small_square: Memorable site for testing clients against bad SSL configs
:black_small_square: The HTTPS-Only Standard
:black_small_square: The Web Security Academy
:black_small_square: Burp Scanner - Issue Definitions
:black_small_square: Web application security: what to do when...
:black_small_square: Transport Layer Security (TLS) Parameters
:black_small_square: TLS Redirection (and Virtual Host Confusion)
:black_small_square: TLS Security 6: Examples of TLS Vulnerabilities and Attacks
:black_small_square: Guidelines for Setting Security Headers
:black_small_square: Mozilla Guidelines - Web Security
:black_small_square: Secure your web application with these HTTP headers
:black_small_square: Security HTTP Headers
:black_small_square: Analysis of various reverse proxies, cache proxies, load balancers, etc.
:black_small_square: How HTTPS works ...in a comic!
:black_small_square: Regular-Expressions
:black_small_square: Regexp Security Cheatsheet
:black_small_square: HTTPS on Stack Overflow: The End of a Long Road
:black_small_square: The Architecture of Open Source Applications - Nginx
:black_small_square: BBC Digital Media Distribution: How we improved throughput by 4x
:black_small_square: The C10K problem by Dan Kegel
:black_small_square: The Secret To 10 Million Concurrent Connections
:black_small_square: High Performance Browser Networking
:black_small_square: The System Design Primer
:black_small_square: awesome-scalability
:black_small_square: Web Architecture 101
:black_small_square: Learn where some of the network sysctl variables fit into the Linux/Kernel network flow
:black_small_square: jemalloc vs tcmalloc vs dlmalloc
:black_small_square: On the Impact of Memory Allocation on High-Performance Query Processing
:black_small_square: GLB: GitHub’s open source load balancer
Go back to the Table of Contents or read the next chapters:
Introduction to HTTP.
Introduction to SSL/TLS.
Introduction and explanation of the NGINX mechanisms.
One-liners, commands, utilities for building NGINX, and more.
The basic set of rules to keep NGINX in a good condition.
A few things for troubleshooting configuration problems.
Many methods to make sure the NGINX as fast as possible.
Security and hardening methods in line with best practices.
A few rules about the NGINX proxy server.
Some rules to improve NGINX as a load balancer.
Other interesting rules, not necessarily linked to NGINX.
Here are some configuration examples.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4