Add security headers

beabee-communityrm · Sep 14, 2023 · e107e69 · e107e69
1 parent 6c6f119
commit e107e69
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/nginx.conf b/nginx.conf
@@ -14,6 +14,13 @@ server {
   absolute_redirect off;
   rewrite ^/login/?$ /auth/login permanent;
 
+  # Security headers
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+  add_header X-XSS-Protection "1; mode=block";
+  add_header X-Frame-Options "SAMEORIGIN";
+  add_header X-Content-Type-Options "nosniff";
+  add_header Referrer-Policy "strict-origin";
+
   # Frontend app
 
   location ~ ^/(assets|profile|contacts|callouts|join|auth|admin|_theme) {