From 602947a3d7bbc495ac3084bc8f180139b1f7d4a6 Mon Sep 17 00:00:00 2001 From: BenBE Date: Thu, 6 Apr 2017 17:30:26 +0200 Subject: [PATCH] Add more security headers (#458) * Include some missing security headers This change adds the following security headers: * X-Content-Type-Options to prevent content type sniffing * Referrer-Policy to prevent leaking referrer information when navigating away from the instance * Migrate from Docker sample to manual configuration Migrate the additional security headers from the Docker configuration sample to the manual configuration guide. --- deployment/docker/nginx.conf | 2 ++ doc/admin/installation/manual_smallscale.rst | 3 +++ 2 files changed, 5 insertions(+) diff --git a/deployment/docker/nginx.conf b/deployment/docker/nginx.conf index 98f95f7e7..376abbdab 100644 --- a/deployment/docker/nginx.conf +++ b/deployment/docker/nginx.conf @@ -22,9 +22,11 @@ http { include /etc/nginx/mime.types; default_type application/octet-stream; + add_header X-Content-Type-Options nosniff; access_log /var/log/nginx/access.log private; error_log /var/log/nginx/error.log; + add_header Referrer-Policy same-origin gzip on; gzip_disable "msie6"; diff --git a/doc/admin/installation/manual_smallscale.rst b/doc/admin/installation/manual_smallscale.rst index 1361963c2..744fc3be3 100644 --- a/doc/admin/installation/manual_smallscale.rst +++ b/doc/admin/installation/manual_smallscale.rst @@ -213,6 +213,9 @@ The following snippet is an example on how to configure a nginx proxy for pretix ssl_certificate /path/to/cert.chain.pem; ssl_certificate_key /path/to/key.pem; + add_header Referrer-Options same-origin; + add_header X-Content-Type-Options nosniff; + location / { proxy_pass http://localhost:8345/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;