The Automation Controller NGINX web server must limit the character set used for data entry.

It is important that Automation Controller NGINX web server limit the character set used for data entry and disallow Unicode use in hosted applications to avoid application compromise. Definition of the available character set for data entry can trap efforts to bypass security checks. The presence of nonstandard characters may cause the browser to interpret the content using a different character set than the defined one, because the system may interpret the content using a different CHARSET. Nonstandard encodings can be used to bypass the application's defensive filters.

If character sets for data entry are not defined, it leaves open the door for attackers to bypass security checks and make the server vulnerable to malicious attack.

As a system administrator (SA) for each Automation Controller NGINX web server, verify the NGINX configuration includes a default charset directive:

nginx -T 2>&1 | grep -E '^\s*charset\s' || echo "FAILED"

If "FAILED" is displayed, this is a finding.

(Note: On a default AAP 2.6 installation, this directive is not present. The fix below must be applied.)

As an SA for each Automation Controller NGINX web server, add the charset directive to the NGINX configuration.

Identify the active configuration files: nginx -T 2>&1 | grep '# configuration file'

Edit the server block (within the http {} context) and add: charset utf-8;

Validate and reload: nginx -t && systemctl reload nginx

For containerized deployments, apply the directive within the container's NGINX configuration and restart the container service.