Robert Kaussow
701d2282a8
All checks were successful
continuous-integration/drone/push Build is passing
30 lines
1.3 KiB
Django/Jinja
30 lines
1.3 KiB
Django/Jinja
#jinja2: lstrip_blocks: True
|
|
{{ ansible_managed | comment }}
|
|
|
|
# protect against protocol downgrading and cookie hijacking
|
|
# https://owasp.org/www-project-secure-headers/#http-strict-transport-security
|
|
{% if nginx_tls_hsts_enabled and nginx_hsts_options is defined%}
|
|
add_header Strict-Transport-Security "{{ nginx_hsts_options | join('; ') }}" always;
|
|
{% endif %}
|
|
|
|
# improve the protection against Clickjacking
|
|
# https://owasp.org/www-project-secure-headers/#x-frame-options
|
|
{% if nginx_xfo_enabled %}
|
|
add_header X-Frame-Options {{ nginx_xfo_policy }} always;
|
|
{% endif %}
|
|
{% if nginx_csp_enabled and nginx_csp_options is defined %}
|
|
add_header Content-Security-Policy "{% for item in nginx_csp_options %}{{ item.directive }} {{ item.parameters | join(' ') }};{% endfor %}" always;
|
|
{% endif %}
|
|
|
|
# prevent from interpreting files as something else than declared by the content type in HTTP headers
|
|
# https://owasp.org/www-project-secure-headers/#x-content-type-options
|
|
{% if nginx_xcto_enabled %}
|
|
add_header X-Content-Type-Options nosniff always;
|
|
{% endif %}
|
|
|
|
# enables the cross-site scripting (XSS) filter of the browsers
|
|
# https://owasp.org/www-project-secure-headers/#x-xss-protection
|
|
{% if nginx_xxxsp_enabled %}
|
|
add_header X-XSS-Protection "{{ nginx_xxxsp_parameters | default([]) |join(' ; ') }}" always;
|
|
{% endif %}
|