Feature/lab11

[Uiyrte]

Goal

• Explain reverse proxy security value (TLS termination, security headers, request filtering, single endpoint).
• Show why hiding application ports reduces the attack surface.
• Document security headers, TLS findings, rate-limiting, and timeouts with evidence.
• Provide a short conclusion and list artifacts for submission.

Changes

• Clarified and paraphrased technical explanations (TLS, headers, rate-limiting, timeouts).
• Confirmed HSTS is present for HTTPS only (verified via headers-https.txt & headers-http.txt).
• Added Nginx config snippet and docker compose ps output as evidence that only Nginx exposes host ports.
• Improved rate-limit explanation, test output interpretation, and timeout trade-offs.

Testing

• docker compose ps output shows only Nginx publishes host ports; Juice Shop only listens internal port 3000 (evidence in labs/submission11.md).
• Testssl run (see labs/lab11/analysis/testssl.txt): TLS 1.2 and TLS 1.3 are supported; strong AEAD ciphers (listed) and Forward Secrecy enabled; testssl warns of a self-signed certificate; OCSP/CRL and stapling not configured.
• Headers check (see labs/lab11/analysis/headers-https.txt and headers-http.txt) confirmed HSTS only on HTTPS and other security headers present on HTTPS responses.
• Rate-limit test (curl repeated login POSTs) produced: 6× 401 Unauthorized (invalid creds) followed by 6× 429 Too Many Requests — confirms limit_req and limit_req_status 429 behavior.
• nginx.conf analysis (labs/lab11/reverse-proxy/nginx.conf) confirmed settings: limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;, burst=5, all relevant timeout values and header injection.
• Access logs (labs/lab11/logs/access.log) show 401 and 429 entries, as expected.

Artifacts & Screenshots

• labs/submission11.md
• labs/lab11/reverse-proxy/nginx.conf
• labs/lab11/analysis/testssl.txt
• labs/lab11/analysis/headers-https.txt and headers-http.txt
• labs/lab11/logs/access.log

Checklist

• Clear title
• Docs updated if needed
• No secrets/large temp files
• Task 1 — Reverse proxy compose setup
• Task 2 — Security headers verification
• Task 3 — TLS + HSTS + rate limiting + timeouts (+ testssl)