How to fix in nginx security config

Question

I am having trouble with my nginx security configuration and need help troubleshooting headers. Running Ubuntu 22.04 with nginx 1.18.

KFSys · Answer

Heya, The thing to sort out first is that this isn’t really an nginx problem. That payload running means some user input is getting reflected into your HTML without being escaped, and that’s happening in your application code, not in the header config. No security header will fix a page that echoes raw input back into the DOM, so start by finding where that value gets rendered and make sure it’s HTML-escaped on output. That’s the actual fix. Where nginx does help is as a second layer. A Content-Security-Policy header like default-src ‘self’ will stop inline event handlers like onerror from firing even if something slips through, and X-Content-Type-Options: nosniff plus X-Frame-Options: SAMEORIGIN are worth setting while you’re in there. Just treat CSP as a safety net behind proper escaping, not the fix itself, because a determined payload can often be shaped around a loose policy.

KFSys · Answer

For a basic reverse proxy to a backend on port 3000, the core of it is a location block like this: location / { proxy_pass http://127.0.0.1:3000; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; } The four X-Forwarded/Host headers are the important part. Without them your backend sees every request as coming from 127.0.0.1 and thinks it’s on plain HTTP, which breaks anything doing redirects or logging real client IPs. If your app uses websockets, add proxy_set_header Upgrade $http_upgrade; and proxy_set_header Connection “upgrade”; in there too. On timeouts, 60s is a sane default. Only bump proxy_read_timeout higher if you have genuinely long-running requests like large uploads or streaming responses, otherwise you just hold sockets open longer than you need to. Since you’re already on a DigitalOcean VPS, this runs fine on the smallest size for a single backend, so no need to size up for the proxy layer itself.

Bobby · Answer

Hi there, A bit more context would help here. What specific issue are you seeing? Are headers not being set, being stripped, causing browser errors, or something else? That said, here is a solid baseline security header config that covers most cases: server { # ...your existing config... add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; } A few things worth knowing with Nginx headers: The always flag is important. Without it, headers only get added on 200 responses and not on error pages. If you are using a reverse proxy setup, headers set in the server block can sometimes get overridden in location blocks. If a header is not showing up, check that it is not being redefined somewhere further down. You can verify what headers are actually being sent with: curl -I https://yourdomain.com If you share what specific problem you are running into it will be easier to point you at the exact fix.

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

How to fix in nginx security config

Related questions

How to tell if your reverse proxy is buffering your token stream (and why I had to rent a Droplet to find out)

How can I improve the speed of an e-commerce website?

How to optimize Nginx reverse proxy caching for media streaming apps?

How to configure Nginx reverse proxy on Ubuntu

How to change existing certbot/nginx to wildcard domain?

How do I get Ruby with Hanami to serve dynamic files via Falcon?

Unable to access the URL after deploying Discourse

AstroJS project hosted on DigitalOcean droplet with Nginx – CSS loading as text/html

Setting up a reverse proxy on DigitalOcean App Platform to route main domain and subdomains

using shiny-server with nginx

Django/Nginx/Gunicorn "unknown errors" in nginx logs

Problem running multiple workers with gunicorn/nginx to deploy python/flask web app

Report this

How to fix in nginx security config

Related questions

How to tell if your reverse proxy is buffering your token stream (and why I had to rent a Droplet to find out)

How can I improve the speed of an e-commerce website?

How to optimize Nginx reverse proxy caching for media streaming apps?

How to configure Nginx reverse proxy on Ubuntu

How to change existing certbot/nginx to wildcard domain?

How do I get Ruby with Hanami to serve dynamic files via Falcon?

Unable to access the URL after deploying Discourse

AstroJS project hosted on DigitalOcean droplet with Nginx – CSS loading as text/html

Setting up a reverse proxy on DigitalOcean App Platform to route main domain and subdomains

using shiny-server with nginx

Django/Nginx/Gunicorn "unknown errors" in nginx logs

Problem running multiple workers with gunicorn/nginx to deploy python/flask web app