diff options
Diffstat (limited to 'nginx/base.sls')
| -rw-r--r-- | nginx/base.sls | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/nginx/base.sls b/nginx/base.sls index cd0bf2f..b876202 100644 --- a/nginx/base.sls +++ b/nginx/base.sls @@ -31,7 +31,7 @@ nginx: snippets: security_headers: # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security - - add_header: 'Strict-Transport-Security "max-age=31536000"' + - add_header: Strict-Transport-Security "max-age=31536000" # Tell browsers not to render the page inside a frame, and avoid clickjacking. - add_header: X-Frame-Options SAMEORIGIN @@ -41,10 +41,10 @@ nginx: # Enable the Cross-site scripting filter in most recent browsers. # Normally enabled by default, but enable it anyway if user has disabled it. - - add_header: 'X-XSS-Protection "1; mode=block"' + - add_header: X-XSS-Protection "1; mode=block" - - add_header: 'Referrer-Policy: same-origin' - - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment" + - add_header: Referrer-Policy same-origin + - add_header: Feature-Policy "geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment 'none'" servers: managed_opts: @@ -56,4 +56,4 @@ nginx: dir_opts: clean: 'on' -# vim: ft=yaml et: +# vim: ft=yaml et ts=2 sts=2 sw=2: |