20 lines
1.2 KiB
Plaintext
20 lines
1.2 KiB
Plaintext
# -----------------------------------------------------------------------------
|
|
# Security headers, kept in one file and `include`d into every location.
|
|
#
|
|
# Why an include rather than declaring these once at server level: nginx's
|
|
# add_header is *replacing*, not additive - the moment a location block
|
|
# declares any add_header of its own (a Cache-Control, say), every header
|
|
# inherited from the enclosing server block is silently dropped. That is easy
|
|
# to miss precisely because nothing fails: the page still loads, just without
|
|
# its protections. Including the same snippet everywhere makes each location
|
|
# self-contained, so adding a Cache-Control to a block can no longer disarm it.
|
|
#
|
|
# Note there is deliberately no Content-Security-Policy here: the SPA and the
|
|
# API documentation need different policies, so each location sets its own.
|
|
# -----------------------------------------------------------------------------
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|