36 lines
1.7 KiB
Plaintext
36 lines
1.7 KiB
Plaintext
# Nginx security headers for post-quantum-nostr (G56-08)
|
|
#
|
|
# Add these to the nginx server block for laantungir.net/post-quantum.
|
|
# These headers cannot be fully enforced from HTML meta tags alone —
|
|
# they must be set by the server.
|
|
|
|
# HSTS: force HTTPS for 1 year, include subdomains, preload-ready
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
|
|
# Prevent MIME-type sniffing
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# Prevent clickjacking (also enforced via CSP frame-ancestors 'none' in HTML)
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
# Don't leak the URL via referrer headers (also set via <meta name="referrer"> in HTML)
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
|
|
# Restrict browser features — this web app needs none of these
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
|
|
|
|
# Cross-Origin Opener Policy: isolate browsing context
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
|
|
# Cross-Origin Resource Policy: restrict resource loading to same-origin
|
|
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
|
|
|
# Note: The CSP is set via <meta http-equiv="Content-Security-Policy"> in the HTML
|
|
# files. If you prefer to set it via nginx instead (recommended for production),
|
|
# replace the meta tag with:
|
|
#
|
|
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; connect-src wss: https:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none';" always;
|
|
#
|
|
# Setting CSP via nginx is stronger because it cannot be stripped by an HTML
|
|
# injection that modifies the <head>.
|