BasicRule
The `BasicRule` directive allows the configuration of basic filtering rules within the NGINX Anti XSS & SQL Injection module to protect against web vulnerabilities.
Description
The BasicRule directive is part of the NGINX Anti XSS & SQL Injection (Naxsi) module, which provides mechanisms to mitigate potential web vulnerabilities. It serves as a drop-by-default firewall, meaning that it blocks all traffic unless explicitly allowed by predefined rules. The BasicRule directive accepts one or more arguments that define the patterns to match incoming requests against. These patterns can include specific characters or strings associated with XSS and SQL injection attacks, effectively acting as a simple rule-based firewall to safeguard web applications.
The parameters provided to BasicRule can be tailored to the application's requirements; for instance, you may want to define rules that specifically target certain request methods or content types. Once defined, these rules help the module determine how to handle requests—either allowing them based on permitted patterns or blocking them if they match known attack signatures. The administrator is responsible for refining these rules, potentially utilizing auto-learning features present in the Naxsi module to automatically generate whitelisted behaviors from legitimate traffic.
Because the Naxsi module does not rely on a signature-based system, it can protect against unknown patterns and attacks, enhancing the overall security posture of web applications deployed on an NGINX server. Effective usage of the BasicRule directive requires careful planning and regular updates to ensure that valid application traffic is not incorrectly blocked while still maintaining a strong defense against malicious activities.
Config Example
server {
location / {
BasicRule "<";
BasicRule "|";
BasicRule "drop";
}
}Be cautious with broad patterns that may also match legitimate user input, as they might inadvertently block valid requests.
Always test new rules in a staging environment before deploying to production to avoid disruption to legitimate traffic.
Regularly review Nginx error logs to analyze behavior and modify rules as needed.