Add headers to support site nginx config #6
Conversation
files/default.conf
Outdated
| add_header Strict-Transport-Security 'max-age=6307200; includeSubDomains; preload'; | ||
| add_header X-Content-Type-Options nosniff; | ||
| add_header X-Frame-Options "SAMEORIGIN"; | ||
| add_header X-XSS-Protection "1; mode=block"; |
There was a problem hiding this comment.
Sorry if Mozilla is giving conflicting recommendations 😳 but let's not include X-XSS-Protection since it's not supported by modern browsers and not recommended by MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
files/default.conf
Outdated
| add_header Content-Security-Policy "default-src *; style-src 'self' 'unsafe-inline'"; | ||
| add_header Strict-Transport-Security 'max-age=6307200; includeSubDomains; preload'; | ||
| add_header X-Content-Type-Options nosniff; | ||
| add_header X-Frame-Options "SAMEORIGIN"; |
There was a problem hiding this comment.
X-Frame-Options like this will prevent people from iframeing our support documentation, and I'd rather continue letting them do it. I may have to eat my words later if the burden of people complaining about issues flagged by automated security scanning tools outweighs the benefit we get from allowing the community to reuse our content inside iframes.
| @@ -40,6 +40,12 @@ server { | |||
| root /var/www/html; | |||
| index index.html; | |||
|
|
|||
| add_header Content-Security-Policy "default-src *; style-src 'self' 'unsafe-inline'"; | |||
There was a problem hiding this comment.
This is very permissive and probably could be tightened up a lot, but the support page is not a web application and never displays user-generated content. Let's not spend more time on it.
JacquelineMorrissette
force-pushed
the
add-headers-to-support
branch
from
85225a2 to
5083eda
Compare
Description
Add headers requested by Mozilla Observatory to
https://support.kobotoolbox.org's nginx config