From 07f8db369f95e69db8779c856c59ab33905c3f4a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:14:04 -0700 Subject: Trim the header notes in the server configs Each config listed every header cgit sends, where only its own nosniff and strict policy on raw bytes bear on the headers set there. The list also missed Vary, and the Apache one called Apache a proxy. --- custom/servers/apache.conf | 9 ++------- custom/servers/lighttpd.conf | 9 ++------- custom/servers/nginx.conf | 12 +++--------- 3 files changed, 7 insertions(+), 23 deletions(-) diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf index 80f750e..33b5439 100644 --- a/custom/servers/apache.conf +++ b/custom/servers/apache.conf @@ -204,13 +204,8 @@ AddType text/plain .txt LimitRequestBody 65536 # Site-wide security headers are set here so they also cover the static - # assets Apache serves. cgit itself sends only the headers the proxy - # cannot supply. Those are Status, Content-Type, Content-Length and - # Content-Disposition on downloads, Location on redirects, a Cache-Control - # marking the login page no-store and a page behind an auth filter private, - # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of - # its own next to the stricter policy "default-src 'none'". Everything - # else, this policy included, is the proxy's job. + # assets Apache serves. On raw repository bytes cgit sends a nosniff and + # the stricter policy "default-src 'none'" of its own. # # The word setifempty is load bearing on the two headers cgit can also # emit. "Header always set" replaces a same-named header even when the diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf index 8fef3c4..fc3e6f4 100644 --- a/custom/servers/lighttpd.conf +++ b/custom/servers/lighttpd.conf @@ -75,13 +75,8 @@ $HTTP["host"] == "git.example.org" { setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" ) # Site-wide security headers are set here so they also cover the static - # assets lighttpd serves. cgit itself sends only the headers the server - # cannot supply. Those are Status, Content-Type, Content-Length and - # Content-Disposition on downloads, Location on redirects, a Cache-Control - # marking the login page no-store and a page behind an auth filter private, - # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of - # its own next to the stricter policy "default-src 'none'". Everything - # else, this policy included, is the server's job. + # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and + # the stricter policy "default-src 'none'" of its own. # # The add in add-response-header is load bearing. It appends a second # copy next to what cgit emitted, so a raw page carries both policies and diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf index 2ab4793..0cdf3ec 100644 --- a/custom/servers/nginx.conf +++ b/custom/servers/nginx.conf @@ -152,15 +152,9 @@ http { ssl_session_timeout 1d; ssl_session_tickets off; - # Site-wide security headers sit here because they must also cover the - # static assets nginx serves directly. cgit itself sends only the - # headers the proxy cannot supply. Those are Status, Content-Type, - # Content-Length and Content-Disposition on downloads, Location on - # redirects, a Cache-Control marking the login page no-store and a page - # behind an auth filter private, the auth filter's Set-Cookie, and on - # raw repository bytes a nosniff of its own next to the stricter policy - # "default-src 'none'". Everything else, this policy included, is the - # proxy's job. + # Site-wide security headers are set here so they also cover the + # static assets nginx serves. On raw repository bytes cgit sends a + # nosniff and the stricter policy "default-src 'none'" of its own. # # add_header appends and never replaces what cgit sent, so a raw page # carries both policies and the browser enforces the stricter one, -- cgit