Merge pull request #32 from PrivateBin/security-headers

new security headers, recommended by ZAP scan #29
PrivateBin · Apr 6, 2021 · bd1a39f · bd1a39f
2 parents a86fc49 + 7b367ca
commit bd1a39f
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/etc/nginx/http.d/site.conf b/etc/nginx/http.d/site.conf
@@ -5,6 +5,14 @@ server {
     root /var/www;
     index index.php index.html index.htm;
 
+    add_header Cross-Origin-Embedder-Policy require-corp;
+    add_header Cross-Origin-Resource-Policy same-origin;
+    add_header Cross-Origin-Opener-Policy same-origin;
+    add_header Referrer-Policy no-referrer;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options deny;
+    add_header X-XSS-Protection "1; mode=block";
+
     location / {
         include /etc/nginx/location.d/*.conf;
         try_files $uri $uri/ /index.php$is_args$args;