Added web security headers for nginx configuration
@@ -20,6 +20,7 @@ server {
access_log /var/log/nginx/st2webui.access.log combined;
error_log /var/log/nginx/st2webui.error.log;
+ server_tokens off;
}
server {
@@ -40,6 +41,10 @@ server {
add_header Front-End-Https on;
add_header X-Content-Type-Options nosniff;
+ add_header X-Frame-Options DENY always;
+ add_header Strict-Transport-Security "max-age=3153600;includeSubDomains";
+ add_header Cache-Control "no-store; no-cache; max-age=0; must-revalidate;";
+ add_header X-XSS-Protection "1; mode=block";
location @apiError {
add_header Content-Type application/json always;
@@ -50,6 +55,7 @@ server {
error_page 502 = @apiError;
rewrite ^/api/(.*) /$1 break;
+ server_tokens off;
proxy_pass http://127.0.0.1:9101/;
proxy_read_timeout 90;
@@ -91,6 +97,7 @@ server {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
+ server_tokens off;
# Disable buffering and chunked encoding.
# In the stream case we want to receive the whole payload at once, we don't
@@ -110,6 +117,7 @@ server {
error_page 502 = @authError;
rewrite ^/auth/(.*) /$1 break;
+ server_tokens off;
proxy_pass http://127.0.0.1:9100/;
proxy_read_timeout 90;
@@ -135,5 +143,6 @@ server {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
+ server_tokens off;
}
}
