feat(lab11): hardened nginx + WAF sidecar

[demonit4028]

Goal

Hardened Nginx reverse proxy (TLS 1.3, full security headers, rate limiting) in front of Juice Shop, with ModSecurity WAF + OWASP CRS sidecar blocking SQL injection.

Changes

• labs/lab11/reverse-proxy/nginx.conf — TLS 1.3 only, 6 security headers, rate limiting, connection limits, cipher hardening, OCSP stapling, timeouts
• labs/lab11/docker-compose.yml — replaced nginx:stable-alpine with nginx:stable (Debian/OpenSSL) to fix TLS 1.3 cipher compatibility
• labs/lab11/waf/docker-compose.override.yml — ModSecurity v3 + OWASP CRS sidecar in front of Nginx
• labs/lab11/waf/modsec-override.conf — audit logging override
• submissions/lab11.md — full submission with proof and explanations

Testing

# Task 1 — HTTPS redirect, TLS 1.3, 6 security headers
curl -sI http://localhost
echo | openssl s_client -connect localhost:443 -tls1_3 -brief
curl -skI https://localhost

# Task 2 — Rate limit (54/60 → 429), cipher (X25519 + TLS_AES_256_GCM_SHA384)
seq 1 60 | xargs -n1 -P 30 -I{} curl -sk -o /dev/null -w "%{http_code}\n" https://localhost/rest/user/login
echo | openssl s_client -connect localhost:443 -tls1_3 2>&1 | grep -E "Cipher is|Peer Temp Key"

# Bonus — SQLi blocked by WAF (403) vs Nginx alone (no block)
curl -sk -o /dev/null -w "no-waf: HTTP %{http_code}\n" "https://localhost/rest/products/search?q=%27%20OR%201=1--"
curl -sk -o /dev/null -w "with-waf: HTTP %{http_code}\n" "https://localhost:8443/rest/products/search?q=%27%20OR%201=1--"

Artifacts & Screenshots

• submissions/lab11.md

---

Checklist

• Title follows feat(labN): <topic> format
• No secrets or large temp files committed
• Submission file at submissions/labN.md exists