Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Trim the header notes in the server configs
Each config listed every header cgit sends, where only its own nosniff
and strict policy on raw bytes bear on the headers set there. The list
also missed Vary, and the Apache one called Apache a proxy.
Diffstat (limited to 'custom/servers/lighttpd.conf')
| -rw-r--r-- | custom/servers/lighttpd.conf | 9 |
1 file changed, 2 insertions, 7 deletions
diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf index 8fef3c4..fc3e6f4 100644 --- a/custom/servers/lighttpd.conf +++ b/custom/servers/lighttpd.conf @@ -75,13 +75,8 @@ $HTTP["host"] == "git.example.org" { setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" ) # Site-wide security headers are set here so they also cover the static - # assets lighttpd serves. cgit itself sends only the headers the server - # cannot supply. Those are Status, Content-Type, Content-Length and - # Content-Disposition on downloads, Location on redirects, a Cache-Control - # marking the login page no-store and a page behind an auth filter private, - # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of - # its own next to the stricter policy "default-src 'none'". Everything - # else, this policy included, is the server's job. + # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and + # the stricter policy "default-src 'none'" of its own. # # The add in add-response-header is load bearing. It appends a second # copy next to what cgit emitted, so a raw page carries both policies and |