summaryrefslogtreecommitdiffstats
path: root/nginx
diff options
context:
space:
mode:
Diffstat (limited to 'nginx')
-rw-r--r--nginx/base.sls10
1 files changed, 5 insertions, 5 deletions
diff --git a/nginx/base.sls b/nginx/base.sls
index cd0bf2f..b876202 100644
--- a/nginx/base.sls
+++ b/nginx/base.sls
@@ -31,7 +31,7 @@ nginx:
snippets:
security_headers:
# https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
- - add_header: 'Strict-Transport-Security "max-age=31536000"'
+ - add_header: Strict-Transport-Security "max-age=31536000"
# Tell browsers not to render the page inside a frame, and avoid clickjacking.
- add_header: X-Frame-Options SAMEORIGIN
@@ -41,10 +41,10 @@ nginx:
# Enable the Cross-site scripting filter in most recent browsers.
# Normally enabled by default, but enable it anyway if user has disabled it.
- - add_header: 'X-XSS-Protection "1; mode=block"'
+ - add_header: X-XSS-Protection "1; mode=block"
- - add_header: 'Referrer-Policy: same-origin'
- - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment"
+ - add_header: Referrer-Policy same-origin
+ - add_header: Feature-Policy "geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment 'none'"
servers:
managed_opts:
@@ -56,4 +56,4 @@ nginx:
dir_opts:
clean: 'on'
-# vim: ft=yaml et:
+# vim: ft=yaml et ts=2 sts=2 sw=2: