cis-nginx-v300-5-2-1

name	cis-nginx-v300-5-2-1
description	Ensure timeout values for reading the client header and body are set correctly (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","request-limits","request-filtering"]
cis_id	5.2.1
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 5.2.1 — Ensure timeout values for reading the client header and body are set correctly

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

To protect against slow clients holding connections open indefinitely, NGINX supports several timeout directives. The most important ones for client-facing connections are:

• client_header_timeout: Sets the maximum time the server will wait for a client to send the request header.
• client_body_timeout: Sets the maximum time allowed between sequential read operations when receiving the request body. This timer does not apply to the total time of the transfer.
• send_timeout: Sets the maximum time allowed between sequential write operations when sending a response to the client.

If any of these timeouts are reached, the server closes the connection, freeing up resources.

Rationale

Aggressively low timeout values are a primary defense against slow-read Denial of Service (DoS) attacks. These attacks attempt to exhaust server resources by opening many connections and keeping them alive for as long as possible by sending data extremely slowly. By setting low timeouts, NGINX efficiently closes these malicious connections, preserving resources for legitimate users.

Impact

Setting these values too low can terminate legitimate connections too early. For example, a user uploading a large file over a slow mobile connection could be cut off if client_body_timeout is too aggressive. The values must be carefully evaluated to achieve a balance between security (low values) and functionality (higher values for specific use cases such as file uploads).

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration for the relevant directives:

nginx -T 2>/dev/null | grep -E '^\s*(client_header_timeout|client_body_timeout|send_timeout)'

Verify that these values are explicitly set to a reasonably low, non-default value (e.g., 10-20 seconds) in the main http or server context. If the application requires long-running connections, verify that client_body_timeout is overridden to a higher value in the specific location block that handles uploads.

Remediation

Set reasonably low timeout values globally in your http block. If specific locations require longer timeouts (e.g., for file uploads), override them within that block.