Add additional headers

dfpc-coe · Sep 10, 2024 · f80c334 · f80c334
1 parent c0fb63e
commit f80c334
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/api/nginx.conf b/api/nginx.conf
@@ -26,7 +26,11 @@ http {
         server_tokens off;
 
         add_header X-Content-Type-Options nosniff;
+        add_header X-Frame-Options DENY always;
         add_header Referrer-Policy strict-origin-when-cross-origin;
+        add_header Strict-Transport-Security max-age=31536000; includeSubDomains; preload
+        add_header Permissions-Policy fullscreen=(self), geolocation=(self), clipboard-read=(self), clipboard-write=(self)
+        add_header Content-Security-Policy default-src 'self'; upgrade-insecure-requests;
 
         location / {
             if ($request_uri ~ ^/(.*)\.html) {