Configuring Nixer

Nixer Spring Plugin is configured using the following application properties, which can be specified inside the application.properties or application.yml file, or passed via command line.

Captcha properties

Key Default Value Description
nixer.captcha.recaptcha.http.max-connections 10 Maximum number of connection established
nixer.captcha.recaptcha.http.timeout.connect 1000 Http connection timeout
nixer.captcha.recaptcha.http.timeout.connection-request 1000 Timeout for request for connection from pool
nixer.captcha.recaptcha.http.timeout.read 1000 Socket read timeout
nixer.captcha.recaptcha.key.secret Secret key for Google Recaptcha API
nixer.captcha.recaptcha.key.site Site key for Google Recaptcha API
nixer.captcha.recaptcha.verify-url Http url of Google service used to verify captcha
nixer.login.captcha.condition Determines whether captcha challenge applies
nixer.login.captcha.param g-recaptcha-response Name of Http parameter name containing captcha response

Core properties

Key Default Value Description
nixer.behaviors.log.include-headers true Whether http headers should be logged
nixer.behaviors.log.include-metadata true Whether metadata about request should be logged. Includes pwned check results, ip lookup match, thresholds exceeded
nixer.behaviors.log.include-query-string Whether query part of uri should be logged
nixer.behaviors.log.include-user-info true Whether user info should be logged. Includes ip, username, session_id
nixer.events.elastic.enabled Whether anomaly events should be logged to Elasticsearch. Requires Elastic Search running.
nixer.events.elastic.index Elasticsearch index.
nixer.events.elastic.type _doc Elasticsearch type.
nixer.events.log.enabled Whether anomaly events logging is enabled.
nixer.filter.ip.enabled Whether matching requests IP addresses to defined IP ranges is enabled.
nixer.filter.ip.ip-prefixes-path Location of file resource with the IP ranges. Can be either a “classpath:” pseudo URL, a “file:” URL, or a plain file path.
nixer.filters.dry-run Whether Nixer servlet filters should execute behaviors in dry-run mode.
nixer.rules.failed-login-ratio-level.activation-level 80 Value of failed-login-ratio metric above which an activation event will be generated. Unit of the metric is percent [%] and it is calculated with the following formula: failed-login-ratio = (100 * number or failed logins) / (number of all logins). The activation level together with the deactivation level create hysteresis to better cope with credential stuffing and also to prevent too frequent activation/deactivation events.
nixer.rules.failed-login-ratio-level.deactivation-level 70 Value of failed-login-ratio metric below which a deactivation event will be generated. Unit of the metric is percent [%] and it is calculated with the following formula: failed-login-ratio = (100 * number or failed logins) / (number of all logins). The activation level together with the deactivation level create hysteresis to better cope with credential stuffing and also to prevent too frequent activation/deactivation events.
nixer.rules.failed-login-ratio-level.enabled Whether failed login ratio feature is enabled.
nixer.rules.failed-login-ratio-level.minimum-sample-size 20 Property minimumSampleSize defines the smallest number of login attempts that need to occur within window for the activation to happen. The reason for this property is that when there is a small number of login attempts, we don’t necessarily want to trigger activation.
nixer.rules.failed-login-ratio-level.window Property window defines time period for which the ratio will be calculated. Longer periods would consume more memory (unless external data store is used) and would cause slower reaction to changes in traffic patterns.
nixer.rules.failed-login-threshold Maps rule properties by name that they correspond to
nixer.rules.failed-login-threshold.ip.enabled Whether rule is enabled. Disabled by default.
nixer.rules.failed-login-threshold.ip.threshold Defines at what metric value rule will trigger
nixer.rules.failed-login-threshold.ip.window Window size in minutes that will be used to calculate metric.
nixer.rules.failed-login-threshold.useragent.enabled Whether rule is enabled. Disabled by default.
nixer.rules.failed-login-threshold.useragent.threshold Defines at what metric value rule will trigger
nixer.rules.failed-login-threshold.useragent.window Window size in minutes that will be used to calculate metric.
nixer.rules.failed-login-threshold.username.enabled Whether rule is enabled. Disabled by default.
nixer.rules.failed-login-threshold.username.threshold Defines at what metric value rule will trigger
nixer.rules.failed-login-threshold.username.window Window size in minutes that will be used to calculate metric.

Stigma properties

Key Default Value Description
nixer.stigma.cookie-name Name of HTTP cookie to be used for storing Stigma Token.
nixer.stigma.decryption-key-file Location of file resource with decryption keys to be used for reading Stigma Tokens. Can be either a “classpath:” pseudo URL, a “file:” URL, or a plain file path.
nixer.stigma.encryption-key-file Location of file resource with encryption key to be used for creating Stigma Tokens. Can be either a “classpath:” pseudo URL, a “file:” URL, or a plain file path.
nixer.stigma.stigma-lifetime Amount of time after Stigma is considered expired.

Pwned-check properties

Key Default Value Description
nixer.pwned.check.enabled Indicates pwned-check functionality is enabled.
nixer.pwned.check.max-password-length 50 Limit for length of the checked password. Mitigates the risk of flooding the system with unnaturally long passwords. Passwords longer than this limit will not be checked and treated as false match.
nixer.pwned.check.password-parameter password The HTTP parameter to look for the password when performing the check. Must follow the value of org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter#passwordParameter which is might be changed by org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer. Defaults to the Spring Security default value.
nixer.pwned.check.pwned-file-path Location of leaked credentials data file