4515-nginx-timeout - It is recommended to reset the timeout values for reading client headers and body¶

Rule ID¶

• 4515-nginx-timeout

Category¶

• nginx

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• The client_header_timeout and client_body_timeout directives define the time the server waits to receive the request header or body from the client. If no byte is received from the client within 60 consecutive seconds, a 408 status is returned.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Setting client header and body timeouts helps the server mitigate potential DDoS attacks. By timing out requests, the server can release resources that may be waiting for the body or header.

Risk Items¶

• nginx security

Audit Method¶

• To verify the current settings of the client_body_timeout and client_header_timeout directives, run the following command. You should also manually check the nginx configuration for any statements that may be located outside the /etc/nginx directory. If none exist, the values are set to their defaults.

  grep -ir timeout /etc/nginx
  # The output should contain the following:
  client_body_timeout 10;
  client_header_timeout 10;
  

Remediation¶

• Locate the HTTP or server block in the nginx configuration and add the client_header_timeout and client_body_timeout directives with the desired settings. The example below sets the timeout to 10 seconds.

  client_body_timeout 10;
  client_header_timeout 10;
  

Impact¶

• None

Default Value¶

• By default, the timeout is 60 seconds.

References¶

• None

CIS Controls¶

• None