hantim/hantim-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix nginx security headers not being applied to https responses

Browse Source 
nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options
were silently dropped from all https server blocks. moved all security headers
into a shared snippet (security-headers.inc) included per server block. added
pytest-based header verification that auto-discovers sites from conf files.
This commit is contained in:
Timothy Kim
2026-03-20 15:11:56 -04:00
parent 3b41653c04
commit b7439b23e3
12 changed files with 84 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/nginx/conf.d/garage.hantim.net.conf
+1 -1
View File
@@ -22,7 +22,7 @@ server {
ssl_certificate /etc/letsencrypt/live/garage.hantim.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/garage.hantim.net/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
location / {
proxy_pass http://garage:3903;
docker/nginx/conf.d/haanmind.net.conf
+1 -1
View File
@@ -36,7 +36,7 @@ server {
ssl_certificate /etc/letsencrypt/live/haanmind.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/haanmind.net/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
location /media/ {
proxy_pass http://garage:3902/;
docker/nginx/conf.d/hantim.net.conf
+1 -1
View File
@@ -36,7 +36,7 @@ server {
ssl_certificate /etc/letsencrypt/live/hantim.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/hantim.net/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
location /media/ {
proxy_pass http://garage:3902/;
docker/nginx/conf.d/hcsuzuki.net.conf
+1 -1
View File
@@ -36,7 +36,7 @@ server {
ssl_certificate /etc/letsencrypt/live/hcsuzuki.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/hcsuzuki.net/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
location /media/ {
proxy_pass http://garage:3902/;
docker/nginx/conf.d/s3.hantim.net.conf
+1 -1
View File
@@ -22,7 +22,7 @@ server {
ssl_certificate /etc/letsencrypt/live/s3.hantim.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/s3.hantim.net/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
client_max_body_size 100M;
docker/nginx/conf.d/security-headers.inc
+5
View File
@@ -0,0 +1,5 @@
add_header Strict-Transport-Security "max-age=63072000; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
docker/nginx/conf.d/thekims.family.conf
+1 -1
View File
@@ -36,7 +36,7 @@ server {
ssl_certificate /etc/letsencrypt/live/thekims.family/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/thekims.family/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
location /media/ {
proxy_pass http://garage:3902/;
docker/nginx/conf.d/timothykim.net.conf
+1 -1
View File
@@ -36,7 +36,7 @@ server {
ssl_certificate /etc/letsencrypt/live/timothykim.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/timothykim.net/privkey.pem;
add_header Strict-Transport-Security "max-age=63072000; preload" always;
include /etc/nginx/conf.d/security-headers.inc;
location /media/ {
proxy_pass http://garage:3902/;
docker/nginx/nginx.conf
-3
View File
@@ -13,8 +13,5 @@ http {
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
include /etc/nginx/conf.d/*.conf;
}