nginx

Web Application Security td { padding-right: 10px; } This post is adapted from a presentation at nginx.conf in September 2016. You can view a recording of the presentation on YouTube. Table of Contents 0:00 Introduction 0:17 Acronym Soup A 1:00 Acronym Soup WAF 1:07 Acronym Soup SAST 1:17 Acronym Soup DAST 1:23 Acronym Soup IAST 1:37 Acronym Soup RASP 1:48 Annual Pedants Conference 2:13 Definition of Terms 3:14 Definition of Terms, continued 3:53 Definition of Terms, continued 4:35 Does The Difference Even Matter… 4:56 What You Really Want From A Solution 4:59 What You Really Want From A Solution, continued 5:25 What You Really Want From A Solution, continued 5:58 What You Really Want From A Solution, continued 6:24 Why Does App Sec Have to Change? 6:39 Traditional Application Development 6:56 Traditional Application Security 7:27 Modern Application Development 8:38 Modern [ more… ]

Deploying NGINX Plus as a Highly Available AWS Load Balancer table.nginx-blog, table.nginx-blog th, table.nginx-blog td { border: 1px solid black; } table.nginx-blog th { background-color: #d3d3d3; align: left; padding-left: 5px; padding-right: 5px; padding-bottom: 2px; padding-top: 2px; line-height: 120%; } table.nginx-blog td { padding-left: 5px; padding-right: 5px; padding-bottom: 2px; padding-top: 5px; line-height: 120%; } table.nginx-blog td.center { text-align: center; padding-bottom: 2px; padding-top: 2px; line-height: 120%; } A load balancer often acts as the single entry into a web application, which makes it a critical component in your application delivery infrastructure: load‑balancer downtime means application downtime. To minimize downtime and the user unhappiness that comes with it, you need to deploy your load balancer in a highly available (HA) manner. This blog post compares several methods you can use to achieve HA for NGINX Plus as your AWS load balancer. It is possible [ more… ]

Rate Limiting with NGINX and NGINX Plus One of the most useful, but often misunderstood and misconfigured, features of NGINX is rate limiting. It allows you to limit the amount of HTTP requests a user can make in a given period of time. A request can be as simple as a GET request for the homepage of a website or a POST request on a login form. Rate limiting can be used for security purposes, for example to slow down brute force password guessing attacks. It can help protect against DDoS attacks by limiting the incoming request rate to a value typical for real users, and (with logging) identify the targeted URLs. More generally, it is used to protect upstream application servers from being overwhelmed by too many user requests at the same time. In this blog we will cover [ more… ]