App Security with NGINX Balancer

Basic Security for Applications with NGINX Balancer

Before introducing complex or costly application-security tools, several simple protection mechanisms can be applied directly at the NGINX load-balancer layer. This guide covers password authentication, IP-address blocking, and combining both methods.

In this article

Security Overview

The NGINX load balancer is primarily used to distribute HTTP and TCP traffic between multiple application servers, improving availability and reliability. It is added automatically when more than one application-server node is selected, and it can also be added manually for a single server from the Balancing section of the topology wizard.

NGINX balancer in environment topology
NGINX is added automatically for multiple application servers or can be selected manually from the Balancing block.
AuthenticationProtects application access with a username and password.
IP Address DenyBlocks application access from a specific IP address.
Combined protectionUses both authentication and IP-based access rules together.

Authentication

Authentication restricts application access so only users with valid credentials can proceed.

  1. Generate an htpasswd-compatible hash from the required username and password. Password data should not be stored in plain text.
  2. Return to the dashboard and click Config for the NGINX balancer.
NGINX balancer Config button
Open the NGINX configuration manager.
  1. Inside the conf.d folder, create a new file with a .htpasswd extension, for example password.htpasswd.
Create htpasswd file
Create a new .htpasswd file inside conf.d.
  1. Paste the generated credential hash into the file. Add additional accounts on separate lines when required.
NGINX htpasswd credentials
Paste the generated username/password hash into the .htpasswd file.
  1. Open nginx-jelastic.conf in the conf folder, find the location block in the first server section, and add:
auth_basic           "closed site";
auth_basic_user_file /etc/nginx/conf.d/{htpasswd_file};

Replace {htpasswd_file} with the name of the file containing your hashes, for example password.htpasswd.

NGINX authentication configuration
Add auth_basic and auth_basic_user_file directives to the location block.
Source-specific note: the source normally recommends keeping nginx-jelastic.conf as default/backup configuration and making broader customizations in nginx.conf. For this simple example, it explicitly modifies nginx-jelastic.conf directly.
  1. Save the changes and restart the NGINX balancer.
Restart NGINX balancer
Restart NGINX after saving security configuration changes.

After restart, opening the application displays an authentication dialog. The application loads only after valid credentials are supplied.

NGINX authentication dialog
Users must provide valid credentials before the application opens.

IP Address Deny

If requests from a particular IP address should be blocked, add an NGINX deny rule.

  1. Open Config for the NGINX balancer.
  2. Open nginx-jelastic.conf, locate the location block in the first server section, and add:
deny {IP_ADDRESS};

Replace {IP_ADDRESS} with the address that should be blocked.

NGINX IP deny configuration
Add the deny directive in the application location block.
Allow/deny variation: setting deny all; blocks everyone. You can combine it with an allow directive to permit a specific IP address or address range.

If the simplified deny rule does not work because of a particular platform configuration, the source provides this alternative based on the forwarded client IP header:

if ($http_x_forwarded_for ~* {IP_ADDRESS}) {
    return 403;
}
  1. Save the configuration and restart NGINX.
  2. A user connecting from the denied IP address receives a 403 Forbidden response.
Restart NGINX balancer
Restart NGINX after saving security configuration changes.
NGINX 403 Forbidden
A blocked IP receives a 403 Forbidden response.

Methods Combination

Authentication and IP restrictions can be used together with the NGINX satisfy directive.

satisfy allDefault behavior. The client must satisfy both the IP-access rule and the authentication requirement.
satisfy anyThe client is allowed when at least one access condition is satisfied.

For example, with satisfy any, an unauthenticated user can still access the application if their IP is explicitly allowed. Likewise, a user from an otherwise denied IP can access the application after providing valid credentials.

Combined NGINX security configuration
Combine authentication and IP restrictions with the satisfy directive.

Expected Result

NGINX protects the application at the frontend layer by requiring credentials, blocking selected IP addresses, or enforcing both policies according to the configured satisfy behavior.

Important Notes

  • Store passwords as hashes rather than plain text.
  • Place credential hashes in a .htpasswd file under conf.d.
  • Use auth_basic and auth_basic_user_file for password protection.
  • Use deny to block a specific IP or deny all with allow for an allowlist approach.
  • The alternative $http_x_forwarded_for rule is intended for platform setups where the simple IP-deny rule does not match the real client address.
  • Restart NGINX after changing these security settings.