IgnoreCIDR
The IgnoreCIDR directive specifies a list of CIDR ranges that should be excluded from anti-XSS and SQL injection checks.
Description
The IgnoreCIDR directive in the NGINX Anti XSS & SQL Injection module (NAXSI) allows for the exclusion of specific IP ranges from being subjected to security rules designed to prevent XSS and SQL injection attacks. This directive is particularly useful when you want to allow internal traffic or certain trusted clients that might otherwise trigger the security filters in place. By specifying one or more CIDR notations, server administrators can effectively tune their security settings to avoid false positives from legitimate requests that originate from these IP ranges.
Each entry in the IgnoreCIDR directive must follow the standard CIDR format, which includes an IP address followed by a slash and a number indicating the number of bits in the subnet mask. For instance, 192.168.1.0/24 would ignore all IP addresses in the range from 192.168.1.0 to 192.168.1.255. This directive can be included in various contexts such as http, server, location, and limit_except, which provides flexibility in defining where the exclusion should apply. Multiple CIDR entries can be specified in a single directive to streamline configuration.
It is important to note that while using the IgnoreCIDR directive can help in reducing false positives, care should be taken to avoid excluding ranges that might inadvertently open up vulnerabilities. Therefore, it is advisable to regularly audit and validate the specified CIDR ranges against the security policies of the organization. Proper logging and monitoring of requests from ignored IP addresses is also recommended to detect any unusual activity that may indicate a security breach.
Config Example
server {
listen 80;
server_name example.com;
location / {
IgnoreCIDR 192.168.0.0/16;
# Other configuration directives...
}
}CIDR ranges that are too broad may allow unwanted traffic to bypass security checks.
Changing the specified CIDR ranges requires careful consideration to maintain security integrity.
It is crucial to combine IgnoreCIDR with proper logging to mitigate risks from ignored IPs.