feat(lab11): hardened nginx TLS 1.3 + security headers + rate limiting

[Philip-78]

Goal

Harden Nginx as a reverse proxy in front of Juice Shop: TLS 1.3 only, full security header set, rate limiting, timeouts, cert-rotation runbook.

Changes

• labs/lab11/reverse-proxy/nginx.conf — TLS 1.3, 6 security headers, rate limit on /rest/user/login, connection limits, timeouts
• submissions/lab11.md — all verification outputs + header explanations + runbook + WAF bonus analysis

Testing

• HTTP → HTTPS 308 redirect confirmed
• TLS 1.3 negotiated: Protocol version: TLSv1.3, cipher TLS_AES_256_GCM_SHA384
• All 6 headers present: HSTS, X-CTO, X-FO, Referrer-Policy, Permissions-Policy, CSP-RO
• Rate limit: 54/60 concurrent login requests returned 429

Artifacts

• submissions/lab11.md — full analysis

---

• Task 1 — TLS 1.3 + 6 security headers with proof
• Task 2 — Rate limit + timeouts + cipher hardening + cert-rotation runbook
• Bonus — WAF architecture + OWASP CRS attack/block analysis documented