Nginx container stops webpage displaying correctly

[mtcolman]

Hi,

I'm running an app on OpenShift and I'm trying to move from a vanilla nginx image nginx:1.29.3 to owasp/modsecurity-crs:4.11.0-nginx-202502011102.

My setup is OpenShift route -> nginx proxy -> frontgateapp

I've only got nginx in there because I want to have "nginx + modsecurity" as this aligns to the opensearch setup I have which is configured to receive nginx logs.

In my nginx deployment I have this basic config (/etc/nginx/conf.d/default.conf ):

server {
    listen 8080;
    listen [::]:8080;
    server_name localhost;

    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        proxy_pass http://frontgateservice.cargo-cats.svc.cluster.local:8081/;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

And when I proxy through it, I can load my webpage:

I'm running on OpenShift, and so I can just amend my route to point to either my "nginx service" or my "modsecurity service" which both proxy to the frontgateservice. When I point to "modsecurity service" and try and load my webpage using the inbuilt default.conf I only ever get (about 99% of the time) textual representative of same of the page:

===

===

and even when I overwrite the default.conf to use the same server configuration as on my "vanialla nginx" pod, I am very rarely able to load the actual webpage. About one in 25-50 attempts results in correct webpage load.

I've tried all sorts of buffer changes etc on the modsecurity image, and yet I cannot get the page to load. This is the "frontendservice" I'm trying to load: https://github.com/Contrast-Security-OSS/cargo-cats/tree/main/services/frontgateservice.

Thanks in advance for any help you can provide.

[fzipi]

Looks like your css is not being loaded. Can you inspect the traffic using developer tools and see what files are giving you 404 and correct the urls?

[mtcolman]

Hi @fzipi this is what I get via nginx-modsecurity pod:

and via the nginx pod where it works:

It looks like when it doesn't work, it's not loading anything from cloudflare?

[mtcolman]

I've had to set my /etc/nginx/conf.d/default.conf like this to get the page to load (turning modsecurity off for location = /). Is that to be expected?

(However this only fixes the landing page, when I load /login, it is still getting mangled).

# Nginx configuration for OpenShift route behind nginx-modsecurity

server_tokens off;

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

# HTTP server (internal 8080)
server {
    listen 8080 default_server;

    server_name localhost;
    set $upstream http://frontgateservice.cargo-cats.svc.cluster.local:8081;

    # Exact match for root "/" - static HTML/JS
    location = / {
        root /usr/share/nginx/html;
        index index.html index.htm;
        default_type text/html;
        client_max_body_size 0;

        # Disable ModSecurity for root
        modsecurity off;

        include includes/cors.conf;
        include includes/proxy_backend.conf;
    }

    # Catch-all for all other paths - dynamic endpoints
    location / {
        modsecurity on;

        include includes/cors.conf;
        include includes/proxy_backend.conf;
    }

    include includes/location_common.conf;
}

# SSL server (internal 8443)
server {
    listen 8443 ssl;

    server_name localhost;
    set $upstream http://frontgateservice.cargo-cats.svc.cluster.local:8081;

    ssl_certificate /etc/nginx/conf/server.crt;
    ssl_certificate_key /etc/nginx/conf/server.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_verify_client off;
    ssl_verify_depth 1;

    # Exact match for root "/" - static HTML/JS
    location = / {
        root /usr/share/nginx/html;
        index index.html index.htm;
        default_type text/html;
        client_max_body_size 0;

        # Disable ModSecurity for root
        modsecurity off;

        include includes/cors.conf;
        include includes/proxy_backend.conf;
    }

    # Catch-all for all other paths - dynamic endpoints
    location / {
        modsecurity on;

        include includes/cors.conf;
        include includes/proxy_backend.conf;
    }

    include includes/location_common.conf;
}

[mtcolman]

This is what /login looks like with the above config:

vs the homepage:

I think the ony difference above in the / vs /{something} is modsecurity on; vs modsecurity off;.