Nginx安全架构设计：保护HTTP请求与响应

1. 基础安全配置

1.1 隐藏Nginx版本信息

server_tokens off;

1.2 禁用不必要的HTTP方法

if ($request_method !~ ^(GET|HEAD|POST)$ ) {
    return 405;
}

1.3 限制HTTP协议版本

if ($server_protocol !~* "HTTP/1.1|HTTP/2.0") {
    return 444;
}

2. 请求安全防护

2.1 防止缓冲区溢出攻击

client_body_buffer_size 1k;
client_header_buffer_size 1k;
client_max_body_size 1k;
large_client_header_buffers 2 1k;

2.2 限制请求速率

limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;

server {
    limit_req zone=req_limit burst=20 nodelay;
}

2.3 防止点击劫持

add_header X-Frame-Options "SAMEORIGIN";

3. 响应安全头设置

3.1 安全头配置

add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.example.com; img-src 'self' https://*.example.com data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://www.youtube.com; connect-src 'self' https://api.example.com";

3.2 严格的传输安全

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

4. SSL/TLS配置

4.1 强加密套件

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

4.2 OCSP Stapling

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

5. 访问控制

5.1 IP黑白名单

location /admin {
    allow 192.168.1.0/24;
    allow 10.0.0.1;
    deny all;
}

5.2 地理IP限制

geo $blocked_country {
    default 0;
    CN 1;
    RU 1;
}

server {
    if ($blocked_country) {
        return 403;
    }
}

6. 日志与监控

6.1 安全日志格式

log_format security '$remote_addr - $remote_user [$time_local] '
                   '"$request" $status $body_bytes_sent '
                   '"$http_referer" "$http_user_agent" '
                   '$request_time $upstream_response_time '
                   '$http_x_forwarded_for $server_name';

access_log /var/log/nginx/security.log security;

6.2 敏感信息过滤

map $request_uri $loggable {
    ~*password    0;
    ~*creditcard  0;
    default       1;
}

access_log /var/log/nginx/access.log combined if=$loggable;

7. 高级防护

7.1 ModSecurity集成

load_module modules/ngx_http_modsecurity_module.so;

http {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
}

7.2 防止SQL注入/XSS

set $block_sql_injections 0;
if ($query_string ~ "union.*select.*\(") {
    set $block_sql_injections 1;
}
if ($block_sql_injections = 1) {
    return 403;
}

8. 最佳实践

1. 定期更新Nginx到最新稳定版本
2. 使用最小权限原则运行Nginx工作进程
3. 禁用自动目录索引
4. 限制敏感目录访问
5. 定期审计配置文件和日志
6. 使用自动化工具检查配置安全性
7. 实施零信任网络原则

通过以上配置，可以显著提高Nginx服务器的安全性，保护HTTP请求和响应免受常见攻击。根据实际业务需求，可以进一步调整和优化这些安全措施。