From 7b59e81328ec5b88cee2c385fee6c0e5b1617fdc Mon Sep 17 00:00:00 2001 From: Johannes Löthberg Date: Thu, 30 May 2019 17:23:21 +0200 Subject: Add nginx snippet with security headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Johannes Löthberg --- nginx/base.sls | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/nginx/base.sls b/nginx/base.sls index 587ac71..1bb15bc 100644 --- a/nginx/base.sls +++ b/nginx/base.sls @@ -28,6 +28,24 @@ nginx: - /etc/nginx/conf.d/*.conf - /etc/nginx/sites-enabled/* + snippets: + security_headers: + # https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security + - add_header: 'Strict-Transport-Security "max-age=31536000"' + + # Tell browsers not to render the page inside a frame, and avoid clickjacking. + - add_header: X-Frame-Options SAMEORIGIN + + # Tell browsers to not try to auto-detect the Content-Type. + - add_header: X-Content-Type-Options nosniff + + # Enable the Cross-site scripting filter in most recent browsers. + # Normally enabled by default, but enable it anyway if user has disabled it. + - add_header: 'X-XSS-Protection "1; mode=block"' + + - add_header: Referrer-Policy: same-origin + - add_header: "Feature-Policy: geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment" + servers: managed_opts: require_in: -- cgit v1.2.3-54-g00ecf