79 lines
4.3 KiB
Plaintext
79 lines
4.3 KiB
Plaintext
# security-headers.conf — security baseline for the levineuwirth.org vhost.
|
|
#
|
|
# Place at /etc/nginx/snippets/security-headers.conf and `include` it
|
|
# inside the server { } block of the vhost, alongside the other
|
|
# snippets shipped from this repo:
|
|
#
|
|
# server {
|
|
# server_name levineuwirth.org;
|
|
# root /var/www/levineuwirth.org;
|
|
# ...
|
|
# include snippets/security-headers.conf;
|
|
# include snippets/static-assets.conf;
|
|
# include snippets/popup-proxy.conf;
|
|
# }
|
|
|
|
# Hide the nginx version from error pages and the Server header.
|
|
server_tokens off;
|
|
|
|
# HSTS — one year, with subdomains, preload-eligible. Only safe to
|
|
# enable once HTTPS is the only listener (the :80 vhost should already
|
|
# 301 → https). Once preload is requested via hstspreload.org, the
|
|
# max-age cannot be lowered without removing from the list manually.
|
|
add_header Strict-Transport-Security
|
|
"max-age=31536000; includeSubDomains; preload" always;
|
|
|
|
# Block MIME-sniffing — required for safe text/plain and svg responses.
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
# Defense against clickjacking. Modern browsers honor CSP frame-ancestors
|
|
# (set below); X-Frame-Options is kept for legacy clients.
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
# Strip the Referer header to "scheme + host" on cross-origin requests.
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Default-deny powerful APIs. interest-cohort opts out of FLoC/Topics.
|
|
add_header Permissions-Policy
|
|
"camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
|
|
|
|
# Content Security Policy. Shipped in Report-Only mode initially —
|
|
# promote to enforcing (strip the "-Report-Only" suffix) once the
|
|
# report stream has been clean for a week.
|
|
#
|
|
# External origins justified inline:
|
|
# cdn.jsdelivr.net KaTeX CSS + JS + webfonts (the KaTeX CSS
|
|
# references its fonts relatively, so they
|
|
# resolve to the CDN -> font-src), Vega /
|
|
# Vega-Lite / Vega-Embed, transformers.js
|
|
# (whose onnxruntime fetches its .wasm from
|
|
# the CDN via fetch() -> connect-src)
|
|
# *.basemaps.cartocdn.com Leaflet basemap tiles (photography map only)
|
|
# connect-src API hosts link-popup providers fetched directly via
|
|
# CORS (the list popups.js documents in its
|
|
# header, plus git.levineuwirth.org for the
|
|
# Forgejo provider). The CORS-broken trio
|
|
# (arxiv, archive.org, pubmed) goes through
|
|
# the same-origin /proxy/ instead — see
|
|
# nginx/popup-proxy.conf.
|
|
#
|
|
# Why 'unsafe-inline' on style:
|
|
# - photography.html emits <span style="background:$swatch$"> for
|
|
# palette swatches (data-driven, can't be hashed).
|
|
# - KaTeX adds inline styles when rendering math at runtime.
|
|
#
|
|
# Why 'unsafe-eval' on script:
|
|
# - vega-embed compiles Vega-Lite specs at runtime via new Function().
|
|
# Removing this would require pre-compiling specs at build time.
|
|
# - it also covers WebAssembly.instantiate for onnxruntime-web
|
|
# (semantic search).
|
|
#
|
|
# The value MUST stay on one physical line: nginx has no line
|
|
# continuation inside quoted strings — a trailing backslash would embed
|
|
# literal backslash + LF bytes in the header value, which is illegal in
|
|
# HTTP/2 and gets whole responses rejected by strict clients.
|
|
#
|
|
# To collect violation reports, set up a `report-uri` endpoint and add
|
|
# `report-uri /csp-report;` (and/or `report-to <group>;`) below.
|
|
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: https://*.basemaps.cartocdn.com; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self' https://cdn.jsdelivr.net https://*.wikipedia.org https://api.crossref.org https://api.github.com https://openlibrary.org https://api.biorxiv.org https://www.youtube.com https://git.levineuwirth.org; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests" always;
|