1 file changed, 2 insertions, 7 deletions
diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf
index 80f750e8..33b54390 100644
--- a/custom/servers/apache.conf
+++ b/custom/servers/apache.conf
@@ -204,13 +204,8 @@ AddType text/plain               .txt
     LimitRequestBody 65536
 
     # Site-wide security headers are set here so they also cover the static
-    # assets Apache serves. cgit itself sends only the headers the proxy
-    # cannot supply. Those are Status, Content-Type, Content-Length and
-    # Content-Disposition on downloads, Location on redirects, a Cache-Control
-    # marking the login page no-store and a page behind an auth filter private,
-    # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of
-    # its own next to the stricter policy "default-src 'none'". Everything
-    # else, this policy included, is the proxy's job.
+    # assets Apache serves. On raw repository bytes cgit sends a nosniff and
+    # the stricter policy "default-src 'none'" of its own.
     #
     # The word setifempty is load bearing on the two headers cgit can also
     # emit. "Header always set" replaces a same-named header even when the