7x31/nginxconfig.io
1
0
Fork 0
mirror of https://github.com/digitalocean/nginxconfig.io.git synced 2025-08-28 10:56:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Replace obsoleted X-Frame-Options with frame-ancestors (#272)

Browse Source
This commit is contained in:
Justin Goette
2021-05-25 07:37:08 -04:00
committed by GitHub
parent c261892de4
commit b1b989f172
2 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/nginxconfig/generators/conf/security.conf.js
View File

@@ -30,7 +30,6 @@ export default (domains, global) => {
const config = [];
config.push(['# security headers', '']);
config.push(['add_header X-Frame-Options', '"SAMEORIGIN" always']);
config.push(['add_header X-XSS-Protection', '"1; mode=block" always']);
config.push(['add_header X-Content-Type-Options', '"nosniff" always']);
config.push(['add_header Referrer-Policy', `"${global.security.referrerPolicy.computed}" always`]);

2
src/nginxconfig/templates/global_sections/security.vue
View File

@@ -161,7 +161,7 @@ THE SOFTWARE.
enabled: true,
},
contentSecurityPolicy: {
default: 'default-src \'self\' http: https: data: blob: \'unsafe-inline\'',
default: 'default-src \'self\' http: https: data: blob: \'unsafe-inline\'; frame-ancestors \'self\';',
enabled: true,
},
serverTokens: {