Feature/lab11

[Dart-NEW]

Goal

Complete Lab 11: Reverse Proxy Hardening with Nginx security headers, TLS, HSTS, rate limiting, and timeout analysis.

Changes

• Added labs/submission11.md with command evidence, TLS/header scan summaries, rate-limit results, and hardening trade-offs.
• Captured Lab 11 evidence under labs/lab11/analysis/.
• Captured Nginx access/error logs under labs/lab11/logs/.
• Added certs .gitignore so local self-signed certificate/private key files are not committed.

Testing

• Verified HTTP redirects to HTTPS with HTTP 308.
• Verified HTTPS responds successfully with security headers and HSTS.
• Verified only Nginx publishes host ports; Juice Shop remains internal on Docker network.
• Ran testssl.sh; TLS 1.2 and TLS 1.3 are enabled, older protocols are disabled.
• Verified login rate limiting: 6 invalid attempts returned 401, then 6 excessive attempts returned 429.
• Pre-commit secret scanning passed with no secrets detected.

Artifacts & Screenshots

• labs/submission11.md
• labs/lab11/analysis/docker-compose-ps.txt
• labs/lab11/analysis/headers-http.txt
• labs/lab11/analysis/headers-https.txt
• labs/lab11/analysis/testssl.txt
• labs/lab11/analysis/testssl-clean.txt
• labs/lab11/analysis/rate-limit-test.txt
• labs/lab11/analysis/rate-limit-access-log.txt
• labs/lab11/logs/access.log
• labs/lab11/logs/error.log

Checklist

• Clear title
• Docs updated
• No secrets in code