Diff options
| -rw-r--r-- | custom/servers/apache.conf | 9 | |
| -rw-r--r-- | custom/servers/lighttpd.conf | 9 | |
| -rw-r--r-- | custom/servers/nginx.conf | 12 |
3 files changed, 7 insertions, 23 deletions
diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf index 80f750e..33b5439 100644 --- a/custom/servers/apache.conf +++ b/custom/servers/apache.conf @@ -204,13 +204,8 @@ AddType text/plain .txt LimitRequestBody 65536 # Site-wide security headers are set here so they also cover the static - # assets Apache serves. cgit itself sends only the headers the proxy - # cannot supply. Those are Status, Content-Type, Content-Length and - # Content-Disposition on downloads, Location on redirects, a Cache-Control - # marking the login page no-store and a page behind an auth filter private, - # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of - # its own next to the stricter policy "default-src 'none'". Everything - # else, this policy included, is the proxy's job. + # assets Apache serves. On raw repository bytes cgit sends a nosniff and + # the stricter policy "default-src 'none'" of its own. # # The word setifempty is load bearing on the two headers cgit can also # emit. "Header always set" replaces a same-named header even when the diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf index 8fef3c4..fc3e6f4 100644 --- a/custom/servers/lighttpd.conf +++ b/custom/servers/lighttpd.conf @@ -75,13 +75,8 @@ $HTTP["host"] == "git.example.org" { setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" ) # Site-wide security headers are set here so they also cover the static - # assets lighttpd serves. cgit itself sends only the headers the server - # cannot supply. Those are Status, Content-Type, Content-Length and - # Content-Disposition on downloads, Location on redirects, a Cache-Control - # marking the login page no-store and a page behind an auth filter private, - # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of - # its own next to the stricter policy "default-src 'none'". Everything - # else, this policy included, is the server's job. + # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and + # the stricter policy "default-src 'none'" of its own. # # The add in add-response-header is load bearing. It appends a second # copy next to what cgit emitted, so a raw page carries both policies and diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf index 2ab4793..0cdf3ec 100644 --- a/custom/servers/nginx.conf +++ b/custom/servers/nginx.conf @@ -152,15 +152,9 @@ http { ssl_session_timeout 1d; ssl_session_tickets off; - # Site-wide security headers sit here because they must also cover the - # static assets nginx serves directly. cgit itself sends only the - # headers the proxy cannot supply. Those are Status, Content-Type, - # Content-Length and Content-Disposition on downloads, Location on - # redirects, a Cache-Control marking the login page no-store and a page - # behind an auth filter private, the auth filter's Set-Cookie, and on - # raw repository bytes a nosniff of its own next to the stricter policy - # "default-src 'none'". Everything else, this policy included, is the - # proxy's job. + # Site-wide security headers are set here so they also cover the + # static assets nginx serves. On raw repository bytes cgit sends a + # nosniff and the stricter policy "default-src 'none'" of its own. # # add_header appends and never replaces what cgit sent, so a raw page # carries both policies and the browser enforces the stricter one, |