diff options
| -rw-r--r-- | nginx/base.sls | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/nginx/base.sls b/nginx/base.sls index 587ac71..1bb15bc 100644 --- a/nginx/base.sls +++ b/nginx/base.sls @@ -28,6 +28,24 @@ nginx: - /etc/nginx/conf.d/*.conf - /etc/nginx/sites-enabled/* + snippets: + security_headers: + # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security + - add_header: 'Strict-Transport-Security "max-age=31536000"' + + # Tell browsers not to render the page inside a frame, and avoid clickjacking. + - add_header: X-Frame-Options SAMEORIGIN + + # Tell browsers to not try to auto-detect the Content-Type. + - add_header: X-Content-Type-Options nosniff + + # Enable the Cross-site scripting filter in most recent browsers. + # Normally enabled by default, but enable it anyway if user has disabled it. + - add_header: 'X-XSS-Protection "1; mode=block"' + + - add_header: Referrer-Policy: same-origin + - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment" + servers: managed_opts: require_in: |