evo/Evo.Gateway
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nginx.conf: add csp header

Browse Source
This commit is contained in:
vchikalkin 2024-04-27 13:46:16 +03:00
parent 7ca6fe3eac
commit 1406a95ed0
3 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
config/include/csp.conf Normal file
View File

@ -0,0 +1,10 @@
set $CSP_UPGRADE_INSECURE_REQUESTS "upgrade-insecure-requests;";
set $CSP_DEFAULT_SRC "default-src https: wss: data: blob: 'self';";
set $CSP_BASE_URI "base-uri 'self';";
set $CSP_CONNECT_SRC "connect-src 'self' *.evoleasing.ru wss:;";
set $CSP_WORKER_SRC "worker-src 'self' blob:;";
set $CSP_FONT_SRC "font-src 'self' fonts.gstatic.com fonts.googleapis.com;";
set $CSP_SCRIPT_SRC "script-src 'self';";
set $CSP_STYLE_SRC "style-src 'self' 'unsafe-inline' fonts.googleapis.com;";
set $CSP_OBJECT_SRC "object-src 'none';";
set $CSP_FRAME_ANCESTORS "frame-ancestors 'none';";

2
config/nginx.auth.conf
View File

@ -21,6 +21,7 @@ upstream app {
server {
listen 80;
include /etc/nginx/mime.types;
include /etc/nginx/include/csp.conf;
error_page 401 /login;
@ -56,6 +57,7 @@ server {
include /etc/nginx/include/auth.conf;
add_header Content-Security-Policy "$CSP_UPGRADE_INSECURE_REQUESTS $CSP_DEFAULT_SRC $CSP_BASE_URI $CSP_CONNECT_SRC $CSP_WORKER_SRC $CSP_FONT_SRC $CSP_SCRIPT_SRC $CSP_STYLE_SRC $CSP_OBJECT_SRC $CSP_FRAME_ANCESTORS";
}
location = /health {

3
config/nginx.off.conf
View File

@ -8,6 +8,7 @@ upstream app {
server {
listen 80;
include /etc/nginx/mime.types;
include /etc/nginx/include/csp.conf;
location / {
proxy_pass http://app;
@ -17,6 +18,8 @@ server {
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
add_header Content-Security-Policy "$CSP_UPGRADE_INSECURE_REQUESTS $CSP_DEFAULT_SRC $CSP_BASE_URI $CSP_CONNECT_SRC $CSP_WORKER_SRC $CSP_FONT_SRC $CSP_SCRIPT_SRC $CSP_STYLE_SRC $CSP_OBJECT_SRC $CSP_FRAME_ANCESTORS";
}
location = /health {