STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must revoke access tokens in accordance with organization-defined identification and authentication policy.

DISA Rule

SV-278411r1172756_rule

Vulnerability Number

V-278411

Group Title

SRG-APP-001020

Rule Version

NGNX-APP-003330

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure NGINX Plus to enforce access token revocation mechanisms.

Enable token revocation via introspection endpoint (OIDC/OAuth2):

location = /token/introspect {
internal;
proxy_pass https://auth.example.mil/oauth2/introspect;
proxy_set_header Content-Type "application/x-www-form-urlencoded";
proxy_pass_request_body on;
proxy_set_body "token=$http_authorization";
}

Fail-closed on invalid or revoked token:

location /secure/ {
auth_request /token/introspect;
error_page 401 = @error_revoke;
}

location @error_revoke {
return 401 "Access token revoked or invalid.";
}

Revoke tokens during logout flows:

Redirect logout requests to IdP to invalidate tokens:

location = /logout {
return 302 https://auth.example.mil/logout?token=$http_authorization;
}

Log all token revocation events:

log_format token_revocation '$remote_addr - $remote_user [$time_local] '
'"$request" status=$status '
'token_id="$jwt_jti" revoked="true" ';
access_log /var/log/nginx/token_revocation.log token_revocation;

Check Contents

Verify NGINX Plus revokes or invalidates access tokens:

Check support for token revocation enforcement:

# grep -i "introspect\|revok\|blacklist\|logout" /etc/nginx/conf.d/*.conf

Confirm token validation includes checking revocation status using:
- OAuth2 introspection endpoint.
- Token revocation list.
- Allowlist or deny-list implementation.
- Explicit session logout propagation.

Inspect logout and session termination handling:

# grep -i "session_timeout\|logout\|revoke" /etc/nginx/conf.d/*.conf

Ensure sessions are invalidated upon:
- User logout.
- Token expiration.
- Authentication source change (e.g., password reset).

Token revocation events (manual or automatic) must be logged with user ID, reason, and timestamp.

If NGINX Plus does not support access token revocation or fails to enforce revocation upon compromise or logout, this is a finding.

Vulnerability Number

V-278411

Documentable

False

Rule Version

NGNX-APP-003330

Severity Override Guidance

Verify NGINX Plus revokes or invalidates access tokens:

Check support for token revocation enforcement:

# grep -i "introspect\|revok\|blacklist\|logout" /etc/nginx/conf.d/*.conf

Confirm token validation includes checking revocation status using:
- OAuth2 introspection endpoint.
- Token revocation list.
- Allowlist or deny-list implementation.
- Explicit session logout propagation.

Inspect logout and session termination handling:

# grep -i "session_timeout\|logout\|revoke" /etc/nginx/conf.d/*.conf

Ensure sessions are invalidated upon:
- User logout.
- Token expiration.
- Authentication source change (e.g., password reset).

Token revocation events (manual or automatic) must be logged with user ID, reason, and timestamp.

If NGINX Plus does not support access token revocation or fails to enforce revocation upon compromise or logout, this is a finding.

Check Content Reference

M

Target Key

5720