STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must implement replay-resistant authentication mechanisms for network access.

DISA Rule

SV-278390r1172747_rule

Vulnerability Number

V-278390

Group Title

SRG-APP-000157

Rule Version

NGNX-APP-000590

Severity

CAT II

CCI(s)

• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Weight

10

Fix Recommendation

Implement a replay-resistant authentication method for any NGINX Plus resource that allows network access.

Option A: JWT with expiration:

Configure NGINX to use JWT authentication:

auth_jwt "Protected";
auth_jwt_key_file /etc/nginx/keys/jwt_key.pub;
auth_jwt_require exp iat;

Ensure the token issuer includes a short-lived exp (e.g., less than five minutes) and iat claims.

Option B: Mutual TLS:

Enable client certificate authentication:

ssl_verify_client on;
ssl_client_certificate /etc/nginx/certs/client_ca.pem;

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify authentication mechanism in use by checking whether NGINX is configured to protect access to administrative interfaces or APIs:

grep -Ri 'auth_' /etc/nginx/nginx.conf
grep -Ri 'proxy_pass' /etc/nginx/nginx.conf
grep -Ri 'ssl_verify_client' /etc/nginx/nginx.conf

Also inspect references to:

auth_jwt
auth_request
ssl_client_certificate

If JWT is in use, validate the config:

auth_jwt_key_file /etc/nginx/jwt.pub;
auth_jwt_require exp iat;

Ensure the token includes expiration (exp) and ideally issued-at (iat) fields.

If using mutual TLS:

ssl_verify_client on;
ssl_client_certificate /etc/nginx/certs/ca.pem;

Ensure client-side certificate verification is required and the certificate authority (CA) trust is defined.

If using auth_request:

Ensure the upstream authentication server is enforcing replay resistance (such as nonce or short-lived tokens). Validate token behavior and session timeout logic.

If no replay-resistant mechanism is found for network-based access, this is a finding.

Vulnerability Number

V-278390

Documentable

False

Rule Version

NGNX-APP-000590

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Identify authentication mechanism in use by checking whether NGINX is configured to protect access to administrative interfaces or APIs:

grep -Ri 'auth_' /etc/nginx/nginx.conf
grep -Ri 'proxy_pass' /etc/nginx/nginx.conf
grep -Ri 'ssl_verify_client' /etc/nginx/nginx.conf

Also inspect references to:

auth_jwt
auth_request
ssl_client_certificate

If JWT is in use, validate the config:

auth_jwt_key_file /etc/nginx/jwt.pub;
auth_jwt_require exp iat;

Ensure the token includes expiration (exp) and ideally issued-at (iat) fields.

If using mutual TLS:

ssl_verify_client on;
ssl_client_certificate /etc/nginx/certs/ca.pem;

Ensure client-side certificate verification is required and the certificate authority (CA) trust is defined.

If using auth_request:

Ensure the upstream authentication server is enforcing replay resistance (such as nonce or short-lived tokens). Validate token behavior and session timeout logic.

If no replay-resistant mechanism is found for network-based access, this is a finding.

Check Content Reference

M

Target Key

5720