Scenario 1: Business Continuity (DoS Protection)
NIS2 Art. 21.2.c
Test the **Rate Limiter** which protects the infrastructure from flooding attacks, ensuring service continuity.
- Navigate to the /spam/ endpoint.
- Refresh the page rapidly (5-10 times in 5 seconds).
- Observe the response change from "Spam Me!" to 429 Too Many Requests.
Scenario 2: Monitoring & Healthchecks
NIS2 Art. 21.2.a
Verify the automated monitoring endpoint used by orchestration systems (Kubernetes/Railway) to ensure availability.
- Navigate to /health/.
- Verify the JSON response
{"status": "ok"}.
Scenario 3: Access Control & Forensics
NIS2 Art. 21.2.i (MFA) & Art. 21.2.f (Logging)
Test the secure login flow which generates forensic logs (HMAC signed) for every access attempt.
Credentials:
- User: demo
- Pass: Nis2Demo2024!
- Go to /admin/login/.
- Log in with the credentials above.
- Access the protected area. (Note: In a real deployment, these actions generate signed logs in Fluent Bit/SIEM).
Scenario 4: Infrastructure Hardening
NIS2 Art. 21.2.g (Hygiene)
Inspect the HTTP headers to verify security hardening applied automatically by the middleware.
- Open Developer Tools (F12) -> Network tab.
- Refresh any page.
- Inspect the Response Headers for:
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Strict-Transport-Security (HSTS)
- Referrer-Policy: same-origin