61 lines
4.0 KiB
Django/Jinja
61 lines
4.0 KiB
Django/Jinja
## Managed by Ansible ##
|
|
|
|
# Add headers to serve security related headers
|
|
# Before enabling Strict-Transport-Security headers please read into this
|
|
# topic first.
|
|
# add_header Strict-Transport-Security "max-age=15768000;
|
|
# includeSubDomains; preload;";
|
|
#
|
|
# WARNING: Only add the preload option once you read about
|
|
# the consequences in https://hstspreload.org/. This option
|
|
# will add the domain to a hardcoded list that is shipped
|
|
# in all major browsers and getting removed from this list
|
|
# could take several months.
|
|
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";
|
|
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
|
|
|
|
# config to don't allow the browser to render the page inside an frame or iframe
|
|
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
|
|
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
|
|
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
|
|
#add_header X-Frame-Options SAMEORIGIN;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
|
|
# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
|
|
# to disable content-type sniffing on some browsers.
|
|
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
|
|
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
|
|
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
|
|
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
|
|
#add_header X-Content-Type-Options nosniff;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
|
|
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
|
|
# this particular website if it was disabled by the user.
|
|
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
|
|
#add_header X-XSS-Protection "1; mode=block";
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
|
|
# you can tell the browser that it can only download content from the domains you explicitly allow
|
|
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
|
|
# https://www.owasp.org/index.php/Content_Security_Policy
|
|
# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
|
|
# directives for css and js(if you have inline css or js, you will need to keep it too).
|
|
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
|
|
#add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self'; style-src 'self' 'unsafe-inline' font-src 'self'; frame-src ; object-src 'none'";
|
|
add_header Content-Security-Policy "frame-ancestors 'self' https://*.{{ webserver_domain }} https://{{ webserver_domain }}";
|
|
|
|
#add_header Referrer-Policy no-referrer;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
|
|
add_header Feature-Policy "accelerometer 'none'; autoplay 'self'; geolocation 'self'; midi 'none'; notifications 'self'; push 'self'; sync-xhr 'self' https://*.{{ webserver_domain }}; microphone 'self'; camera 'self'; magnetometer 'none'; gyroscope 'none'; speaker 'self'; vibrate 'self'; fullscreen 'self'; payment 'none'; usb 'none'";
|
|
add_header Permissions-Policy "geolocation=(self);midi=();notifications=(self);push=(self);sync-xhr=(self 'https://*.{{ webserver_domain }}');microphone=(self);camera=(self);magnetometer=();gyroscope=();speaker=(self);vibrate=();fullscreen=(self);payment=()";
|
|
|
|
add_header X-Robots-Tag "noindex, noimageindex, nofollow, nosnippet, noarchive" always;
|
|
|
|
# Add Alt-Svc header to negotiate HTTP/3.
|
|
add_header Alt-Svc 'h2=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400' always;
|
|
add_header x-quic 'h3' always;
|