Diff options
Diffstat (limited to 'custom/servers/nginx.conf')
| -rw-r--r-- | custom/servers/nginx.conf | 12 |
1 file changed, 3 insertions, 9 deletions
diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf index 2ab4793..0cdf3ec 100644 --- a/custom/servers/nginx.conf +++ b/custom/servers/nginx.conf @@ -152,15 +152,9 @@ http { ssl_session_timeout 1d; ssl_session_tickets off; - # Site-wide security headers sit here because they must also cover the - # static assets nginx serves directly. cgit itself sends only the - # headers the proxy cannot supply. Those are Status, Content-Type, - # Content-Length and Content-Disposition on downloads, Location on - # redirects, a Cache-Control marking the login page no-store and a page - # behind an auth filter private, the auth filter's Set-Cookie, and on - # raw repository bytes a nosniff of its own next to the stricter policy - # "default-src 'none'". Everything else, this policy included, is the - # proxy's job. + # Site-wide security headers are set here so they also cover the + # static assets nginx serves. On raw repository bytes cgit sends a + # nosniff and the stricter policy "default-src 'none'" of its own. # # add_header appends and never replaces what cgit sent, so a raw page # carries both policies and the browser enforces the stricter one, |