NGINX is a powerful web server that provides a wide range of features to secure your web applications. In this blog post, we will demonstrate how to restrict access to your NGINX server based on IP address, HTTP method, authenticate users, and restrict URIs.

Restricting Access to NGINX Based on IP Address

To restrict access to your NGINX server based on IP address, you can use the allow and deny directives. These directives allow you to specify a list of IP addresses that are allowed or denied access to your server.

Here’s an example configuration:

http {
    ...
    allow 192.168.1.0/24;
    deny all;
    ...
}

In this example, only IP addresses in the 192.168.1.0/24 network are allowed to access your server. All other IP addresses will be denied.

You can also specify multiple IP addresses or ranges by separating them with a space:

http {
    ...
    allow 192.168.1.0/24;
    allow 192.168.2.0/24;
    deny all;
    ...
}

Restricting Access to NGINX Based on HTTP Method

To restrict access to your NGINX server based on the HTTP method (e.g., GET, POST, PUT, DELETE), you can use the if directive.

Here’s an example configuration:

http {
    ...
    if ($request_method = 'POST') {
        return 403;
    }
    ...
}

In this example, any incoming request that is not a GET request will be denied with a 403 error.

Authenticating with Basic Authentication

To authenticate users using basic authentication, you can use the auth_basic directive.

Here’s an example configuration:

http {
    ...
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
    ...
}

In this example, the auth_basic directive is used to enable basic authentication and the auth_basic_user_file directive is used to specify the location of the password file.

You will need to create a password file in the specified location with the following format:

username:password

For example:

john:hello
jane:goodbye

Restricting URIs

To restrict access to specific URIs, you can use the location directive.

Here’s an example configuration:

http {
    ...
    location /private {
        auth_basic "Private Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
        require valid-user;
        ...
    }
}

In this example, only users who have authenticated successfully using basic authentication will be allowed to access the /private URI.

Conclusion

In this blog post, we demonstrated how to restrict access to your NGINX server based on IP address, HTTP method, authenticate users using basic authentication, and restrict URIs. By implementing these security measures, you can help protect your web application from unauthorized access and ensure that only authorized users can access sensitive areas of your website.

Remember to always keep your NGINX configuration up-to-date and secure to protect your web application from potential threats.