mirror of
https://github.com/warmbly/warmbly.git
synced 2026-10-13 00:02:43 +00:00
Matthew MeszarosandDevin AI
589bc823ed
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
16 lines
1018 B
Plaintext
16 lines
1018 B
Plaintext
# Security response headers for the dashboard shell and its assets.
|
|
#
|
|
# This file is included once per location rather than set once at the server
|
|
# level, because nginx only inherits add_header from an outer block when the
|
|
# inner block declares none of its own. Every location here sets Cache-Control,
|
|
# so a server-level declaration would be silently dropped in exactly the places
|
|
# that serve the app.
|
|
#
|
|
# The entrypoint fills the built policy's hashes and configured resource origins.
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
|
|
add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|