Mirrors/nginxconfig.io
2
0
Fork 0
mirror of https://github.com/digitalocean/nginxconfig.io synced 2024-11-10 04:24:12 +00:00
Code Issues Projects Releases Packages Wiki Activity

Replace obsoleted X-Frame-Options with frame-ancestors (#272)

Browse source
This commit is contained in:
Justin Goette 2021-05-25 07:37:08 -04:00 committed by GitHub
parent c261892de4
commit b1b989f172
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/nginxconfig/generators/conf/security.conf.js
View file

@ -30,7 +30,6 @@ export default (domains, global) => {
const config = [];
config.push(['# security headers', '']);
config.push(['add_header X-Frame-Options', '"SAMEORIGIN" always']);
config.push(['add_header X-XSS-Protection', '"1; mode=block" always']);
config.push(['add_header X-Content-Type-Options', '"nosniff" always']);
config.push(['add_header Referrer-Policy', `"${global.security.referrerPolicy.computed}" always`]);

2
src/nginxconfig/templates/global_sections/security.vue
View file

@ -161,7 +161,7 @@ THE SOFTWARE.
enabled: true,
},
contentSecurityPolicy: {
default: 'default-src \'self\' http: https: data: blob: \'unsafe-inline\'',
default: 'default-src \'self\' http: https: data: blob: \'unsafe-inline\'; frame-ancestors \'self\';',
enabled: true,
},
serverTokens: {