feat(lab11): hardened nginx + ModSec WAF sidecar + OWASP CRS blocking SQL injection

[Meliman1000-7]

Goal

Configure a production-grade Nginx reverse proxy in front of Juice Shop: TLS 1.3 only, full security-header set, rate limiting, cipher hardening, cert-rotation runbook, and (bonus) ModSecurity v3 + OWASP CRS WAF sidecar that blocks SQL injection payloads Nginx alone passes.

Changes

• labs/lab11/reverse-proxy/nginx.conf — TLS 1.3 only, ssl_prefer_server_ciphers off, HSTS max-age=63072000, 6 security headers with always, limit_req zone=login burst=5, limit_conn zone=conn 50, client/proxy timeouts, cipher suite hardening
• labs/lab11/waf/docker-compose.override.yml — ModSecurity v3.0.16 + OWASP CRS 3.3.10 sidecar (paranoia=1, SecRuleEngine=On, anomaly threshold=5)
• submissions/lab11.md — Task 1 + Task 2 + Bonus writeup with all proofs

Testing

Stack startup:
docker compose up -d
→ lab11-juice-1 Up, lab11-nginx-1 Up (80/443)

HTTP → HTTPS redirect:
curl -sI http://localhost
→ 308 Permanent Redirect → https://localhost/

TLS 1.3 + cipher:
openssl s_client -connect localhost:443 -tls1_3
→ Cipher: AEAD-CHACHA20-POLY1305-SHA256, Server Temp Key: X25519 253 bits

Security headers (all 6):
curl -skI https://localhost
→ strict-transport-security: max-age=63072000; includeSubDomains; preload
→ x-frame-options: DENY
→ x-content-type-options: nosniff
→ referrer-policy: strict-origin-when-cross-origin
→ permissions-policy: camera=(), geolocation=(), microphone=()
→ content-security-policy-report-only: default-src 'self'; ...

Rate limit:
seq 1 60 | xargs -n1 -P 30 curl -sk -o /dev/null -w "%{http_code}\n" https://localhost/rest/user/login | sort | uniq -c
→ 54 × 429, 6 × 500

WAF sidecar:
docker compose -f docker-compose.yml -f waf/docker-compose.override.yml up -d
→ lab11-waf-1 Up (healthy) on 8080/8443

SQL injection through Nginx alone:
curl -sk "https://localhost/rest/products/search?q=%27%20OR%201%3D1--"
→ HTTP 500 (passed through, Juice Shop error)

SQL injection through WAF:
curl -sk "http://localhost:8080/rest/products/search?q=%27%20OR%201%3D1--"
→ HTTP 403 (blocked by rule 942100 — SQL Injection via libinjection, anomaly score 5/5)

Artifacts & Screenshots

• submissions/lab11.md
• labs/lab11/reverse-proxy/nginx.conf
• labs/lab11/waf/docker-compose.override.yml

Checklist

• Title is clear (feat(lab11): style)
• No secrets or large temp files committed (self-signed certs are lab-only, logs not committed)
• Submission file at submissions/lab11.md exists