STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to pass security attributes to proxies.

DISA Rule

SV-278402r1171958_rule

Vulnerability Number

V-278402

Group Title

SRG-APP-000419

Rule Version

NGNX-APP-001840

Severity

CAT II

CCI(s)

• CCI-002455 - Associate organization-defined security attributes with information exchanged between system components.

Weight

10

Fix Recommendation

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Include the "proxy_pass" service as well as the "proxy_set_header" values as required:

proxy_pass http://backend_service;

proxy_set_header X-Security-Classification "Confidential";
proxy_set_header X-Data-Origin "Internal-System";
proxy_set_header X-Access-Permissions "Read,Write";

After saving the configuration, reload NGINX:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify the embedded security attributes are present as HTTP Headers:

server {
listen 443 ssl;
server_name secure-api.example.com;

location /data {
proxy_pass http://backend_service;

proxy_set_header X-Security-Classification "Confidential";
proxy_set_header X-Data-Origin "Internal-System";
proxy_set_header X-Access-Permissions "Read,Write";
}
}
If the "proxy_pass" variable is not set nor the "proxy_set_header" is not set for the required headers, this is a finding.

Vulnerability Number

V-278402

Documentable

False

Rule Version

NGNX-APP-001840

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify the embedded security attributes are present as HTTP Headers:

server {
listen 443 ssl;
server_name secure-api.example.com;

location /data {
proxy_pass http://backend_service;

proxy_set_header X-Security-Classification "Confidential";
proxy_set_header X-Data-Origin "Internal-System";
proxy_set_header X-Access-Permissions "Read,Write";
}
}
If the "proxy_pass" variable is not set nor the "proxy_set_header" is not set for the required headers, this is a finding.

Check Content Reference

M

Target Key

5720