From 61d61feb938bb8a6c79044ac5b48d685b608ce0f Mon Sep 17 00:00:00 2001 From: Tommy Date: Fri, 16 Sep 2022 18:45:58 -0400 Subject: [PATCH 1/6] Improve headers for security --- data/conf/nginx/includes/site-defaults.conf | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/data/conf/nginx/includes/site-defaults.conf b/data/conf/nginx/includes/site-defaults.conf index ef2c4fb8..ec47a544 100644 --- a/data/conf/nginx/includes/site-defaults.conf +++ b/data/conf/nginx/includes/site-defaults.conf @@ -13,14 +13,16 @@ ssl_session_timeout 1d; ssl_session_tickets off; - add_header Strict-Transport-Security "max-age=15768000;"; + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; + add_header X-XSS-Protection "0"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Permitted-Cross-Domain-Policies none; add_header Referrer-Policy strict-origin; + add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()"; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; img-src * https: data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; index index.php index.html; From a7368ab36da14c244a6a819160bfdf8f74176ed1 Mon Sep 17 00:00:00 2001 From: Tommy Date: Sat, 17 Sep 2022 13:14:31 -0400 Subject: [PATCH 2/6] Update site-defaults.conf --- data/conf/nginx/includes/site-defaults.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/conf/nginx/includes/site-defaults.conf b/data/conf/nginx/includes/site-defaults.conf index ec47a544..2f124807 100644 --- a/data/conf/nginx/includes/site-defaults.conf +++ b/data/conf/nginx/includes/site-defaults.conf @@ -13,7 +13,7 @@ ssl_session_timeout 1d; ssl_session_tickets off; - add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"; + add_header Strict-Transport-Security "max-age=15768000; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "0"; add_header X-Robots-Tag none; From 5ad9ebc73bd7ba9ec437d2a8ca7c407ab8a936da Mon Sep 17 00:00:00 2001 From: Tommy Date: Mon, 21 Nov 2022 23:47:25 -0500 Subject: [PATCH 3/6] Add more headers --- data/conf/nginx/includes/site-defaults.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/data/conf/nginx/includes/site-defaults.conf b/data/conf/nginx/includes/site-defaults.conf index 2f124807..5887cc0b 100644 --- a/data/conf/nginx/includes/site-defaults.conf +++ b/data/conf/nginx/includes/site-defaults.conf @@ -23,6 +23,9 @@ add_header Referrer-Policy strict-origin; add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()"; add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; img-src * https: data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; + add_header Cross-Origin-Opener-Policy same-origin; + add_header Cross-Origin-Embedder-Policy require-corp; + add_header Cross-Origin-Resource-Policy same-origin; index index.php index.html; From 2d4ed5c4b3984cce668075db419fed88cee14f52 Mon Sep 17 00:00:00 2001 From: Tommy Date: Mon, 26 Dec 2022 07:30:18 -0500 Subject: [PATCH 4/6] Update CSP for bootstrap theme --- data/conf/nginx/includes/site-defaults.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/conf/nginx/includes/site-defaults.conf b/data/conf/nginx/includes/site-defaults.conf index 5887cc0b..989f9708 100644 --- a/data/conf/nginx/includes/site-defaults.conf +++ b/data/conf/nginx/includes/site-defaults.conf @@ -22,7 +22,7 @@ add_header X-Permitted-Cross-Domain-Policies none; add_header Referrer-Policy strict-origin; add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()"; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; img-src * https: data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self' https://api.github.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; add_header Cross-Origin-Opener-Policy same-origin; add_header Cross-Origin-Embedder-Policy require-corp; add_header Cross-Origin-Resource-Policy same-origin; From 7b9e500cf4ea3b67ec17bb54cf10c669fa0907cd Mon Sep 17 00:00:00 2001 From: Tommy Date: Mon, 26 Dec 2022 12:24:40 -0500 Subject: [PATCH 5/6] Fix gravatar --- data/conf/nginx/includes/site-defaults.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/data/conf/nginx/includes/site-defaults.conf b/data/conf/nginx/includes/site-defaults.conf index 989f9708..d1b7376c 100644 --- a/data/conf/nginx/includes/site-defaults.conf +++ b/data/conf/nginx/includes/site-defaults.conf @@ -22,9 +22,8 @@ add_header X-Permitted-Cross-Domain-Policies none; add_header Referrer-Policy strict-origin; add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()"; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self' https://api.github.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self' https://api.github.com https://www.gravatar.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://www.gravatar.com; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; add_header Cross-Origin-Opener-Policy same-origin; - add_header Cross-Origin-Embedder-Policy require-corp; add_header Cross-Origin-Resource-Policy same-origin; index index.php index.html; From 3661cdc11f38af8e23f78679b82750c4820536e9 Mon Sep 17 00:00:00 2001 From: Tommy Date: Wed, 16 Aug 2023 04:11:55 -0700 Subject: [PATCH 6/6] Add upgrade-insecure-requests; --- data/conf/nginx/includes/site-defaults.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/conf/nginx/includes/site-defaults.conf b/data/conf/nginx/includes/site-defaults.conf index d1b7376c..a3d02792 100644 --- a/data/conf/nginx/includes/site-defaults.conf +++ b/data/conf/nginx/includes/site-defaults.conf @@ -22,7 +22,7 @@ add_header X-Permitted-Cross-Domain-Policies none; add_header Referrer-Policy strict-origin; add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()"; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self' https://api.github.com https://www.gravatar.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://www.gravatar.com; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'"; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self' https://api.github.com https://www.gravatar.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://www.gravatar.com; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content; base-uri 'none'"; add_header Cross-Origin-Opener-Policy same-origin; add_header Cross-Origin-Resource-Policy same-origin;