From e3117c087f15512b3ec029624fac195222c23cd3 Mon Sep 17 00:00:00 2001 From: Daniel Schosser Date: Fri, 24 Apr 2020 14:39:35 +0200 Subject: [PATCH] Add security headers to nginx config Increase the security of the nginx server and the served page, by adding the following security headers to the nginx config: - X-Frame-Options (Disables click jacking by disallowing the page to be run in a frame/iframe) - X-XSS-Protection (Enables cross site scripting filtering) - X-Content-Type-Options (Disables MIME sniffing and forces browser to use the type given in Content-Type.) - Content-Security-Policy (Controls resources the user agent is allowed to load for a given page.) - Referrer-Policy (Governs which referrer information sent in the Referer header should be included with requests made.) Additional headers that could be added optionally: - Strict-Transport-Security (Enforce HTTPS over HTTP) --- config/docker/nginx.conf | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/config/docker/nginx.conf b/config/docker/nginx.conf index bb79f9ce..6d72b7f9 100644 --- a/config/docker/nginx.conf +++ b/config/docker/nginx.conf @@ -17,6 +17,13 @@ http { server_name localhost; index index.html index.htm; + # Add security headers + add_header X-Frame-Options deny always; + add_header X-XSS-Protection "1; mode=block" always; + add_header X-Content-Type-Options nosniff always; + add_header Content-Security-Policy "default-src 'none'" always; + add_header Referrer-Policy strict-origin-when-cross-origin always; + location / { alias /usr/share/nginx/html/;