Alan Orth
4ea152bf51
See: https://github.com/h5bp/server-configs-nginx/blob/master/h5bp/directive-only/extra-security.conf See: https://www.owasp.org/index.php/List_of_useful_HTTP_headers Signed-off-by: Alan Orth <alan.orth@gmail.com>
18 lines
1.0 KiB
Plaintext
18 lines
1.0 KiB
Plaintext
# The X-Frame-Options header indicates whether a browser should be allowed
|
|
# to render a page within a frame or iframe.
|
|
add_header X-Frame-Options SAMEORIGIN;
|
|
|
|
# MIME type sniffing security protection
|
|
# There are very few edge cases where you wouldn't want this enabled.
|
|
add_header X-Content-Type-Options nosniff;
|
|
|
|
# The X-XSS-Protection header is used by Internet Explorer version 8+
|
|
# The header instructs IE to enable its inbuilt anti-cross-site scripting filter.
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
|
|
# with Content Security Policy (CSP) enabled (and a browser that supports it (http://caniuse.com/#feat=contentsecuritypolicy),
|
|
# you can tell the browser that it can only download content from the domains you explicitly allow
|
|
# CSP can be quite difficult to configure, and cause real issues if you get it wrong
|
|
# There is website that helps you generate a policy here http://cspisawesome.com/
|
|
# add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.google-analytics.com;";
|