PCI DSS Best Practices with NGINX Plus

2018-06-05 KENNETH 0

PCI DSS Best Practices with NGINX Plus p.indent { padding-left: 30px; } The Payment Card Industry (PCI) Data Security Standard (DSS), or PCI DSS, is a certification standard for protecting consumer’s credit card numbers and other personal data. It’s easy to implement PCI DSS best practices with NGINX Plus. This blog post tells you how. Moving from SSL to the Latest Version of TLS Secure Sockets Layer (SSL) is dead, and has been for more than a decade. In 2015 the PCI Security Standards Council officially declared it so and published an advisory on moving to the latest versions of Transport Layer Security (TLS), the protocol that supersedes SSL. Here’s the executive summary: For over 20 years Secure Sockets Layer (SSL) has been in the market as one of the most widely used encryption protocols ever released, and remains in widespread use today despite [ more… ]

Batching API Requests with NGINX Plus and the NGINX JavaScript Module

2018-05-25 KENNETH 0

Batching API Requests with NGINX Plus and the NGINX JavaScript Module The version of the NGINX JavaScript module (formerly called nginScript) released with NGINX Plus R15 can now issue subrequests, meaning that requests can be initiated in JavaScript code, allowing a whole new set of use cases to be addressed. One of these use cases is batching API requests so that a single API request from a client can be turned into multiple API requests to a set of backend servers, and the responses aggregated into a single response to the client. This post builds on the subrequest example in the NGINX Plus R15 announcement, which shows how to use subrequests to send the same request to two backend servers, and return only the first response to the client. Introduction The goal of this post is to provide working examples [ more… ]

No Image

Trust No One: The Perils of Trusting User Input

2018-05-22 KENNETH 0

Trust No One: The Perils of Trusting User Input Occasionally, we like to highlight interesting or significant security issues that users of NGINX Open Source and NGINX Plus might encounter. Application stacks are complex and it’s very easy to overlook obscure or unexpected ways that common features can be exploited. NGINX and NGINX Plus are a powerful way to both provide access to these features and restrict access. Careless or unwitting configuration can leave a door open for attackers. We have previously covered attacks that exploit HTTP headers. In the HTTPoxy attack, the attacker uses the HTTP Proxy header to capture internal HTTP requests generated by an application, and in the Apache Struts vulnerability the attacker performs command injection with a carefully constructed Content-Type header. Both attacks exploit little‑known features in the application environment, and are dealt with by intercepting suspect requests. [ more… ]

Deploying NGINX and NGINX Plus as an API Gateway, Part 1

2018-05-17 KENNETH 0

Deploying NGINX and NGINX Plus as an API Gateway, Part 1 table.nginx-blog { width: 100%; } table.nginx-blog th { align: left; padding-left: 5px; padding-right: 5px; padding-bottom: 2px; padding-top: 2px; line-height: 120%; } table.nginx-blog td { padding-left: 5px; padding-right: 5px; padding-bottom: 2px; padding-top: 5px; line-height: 120%; } At the heart of modern application architectures is the HTTP API. HTTP enables applications to be built rapidly and maintained easily. The HTTP API provides a common interface, regardless of the scale of the application, from a single‑purpose microservice to an all‑encompassing monolith. By using HTTP, the advancements in web application delivery that support hyperscale Internet properties can also be used to provide reliable and high‑performance API delivery. For an excellent introduction to the importance of API gateways for microservices applications, see Building Microservices: Using an API Gateway on our blog. As the leading [ more… ]

Deploying NGINX Plus as an API Gateway, Part 1

2018-05-17 KENNETH 0

Deploying NGINX Plus as an API Gateway, Part 1 table.nginx-blog { width: 100%; } table.nginx-blog th { align: left; padding-left: 5px; padding-right: 5px; padding-bottom: 2px; padding-top: 2px; line-height: 120%; } table.nginx-blog td { padding-left: 5px; padding-right: 5px; padding-bottom: 2px; padding-top: 5px; line-height: 120%; } At the heart of modern application architectures is the HTTP API. HTTP enables applications to be built rapidly and maintained easily. The HTTP API provides a common interface, regardless of the scale of the application, from a single‑purpose microservice to an all‑encompassing monolith. By using HTTP, the advancements in web application delivery that support hyperscale Internet properties can also be used to provide reliable and high‑performance API delivery. For an excellent introduction to the importance of API gateways for microservices applications, see Building Microservices: Using an API Gateway on our blog. As the leading high‑performance, lightweight [ more… ]