Add Referrer-Policy header

Add X-Content-Type-Options header
Add X-Frame-Options header
2021-02-13 03:49:55 +01:00 · 2021-02-13 03:39:12 +01:00 · 2021-02-13 03:33:12 +01:00 · 2021-02-13 03:28:30 +01:00
1 changed files with 4 additions and 0 deletions
--- a/roles/nginx/templates/etc/nginx/sites-available/site-vhost.j2
+++ b/roles/nginx/templates/etc/nginx/sites-available/site-vhost.j2
@ -26,6 +26,10 @@ server {
    listen [::]:443 ssl;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    {% if item.ssl_certificate is defined %}ssl_certificate {{ item.ssl_certificate }};{% endif %}
Author	SHA1	Message	Date
Daniele Tricoli	9c55da0a2b	Add Referrer-Policy header	2021-02-13 03:49:55 +01:00
Daniele Tricoli	47bd755709	Add X-Content-Type-Options header	2021-02-13 03:39:12 +01:00
Daniele Tricoli	566feeefb0	Add X-Frame-Options header	2021-02-13 03:33:12 +01:00
Daniele Tricoli	4a49264b40	Add Content Security Policy header	2021-02-13 03:28:30 +01:00