Closed thelittlefireman closed 3 years ago
Hello @thelittlefireman,
You're right, I can't tell if the reverse proxy will override the header of the proxied server. We need to test it. Regarding Expect-CT, looks like it will become obsolete from your link : "The Expect-CT will likely become obsolete in June 2021."
Hi @thelittlefireman,
As discussed in #155, we can set the corresponding environment variable to nothing (e.g. : COOKIE_FLAGS=
) so the app one will be forwarded.
For now we have two undocumented choices :
Another possible feature would be to replace/append specific values in a header defined by the app (e.g. : allow/deny a specific permissions within the Permissions-Policy
header). I don't have any idea on how to do it for now but it should be generic IMO (e.g. : use a regex pattern to replace things). What do you think ?
I've added some tips about app vs bunkerized-nginx headers on the documentation. Feel free to open a new issue if needed !
Hi, Could it be possible to upgrade default configuration for these headers ? :
set "always" (The "always" parameters is to guarantee that the header is et on ALL responses)
add_header X-XSS-Protection "1; mode=block" always; add_header Strict-Transport-Security "max-age=expireTime [; includeSubDomains] [; preload]" always; add_header X-Content-Type-Options "nosniff" always; add_header Feature-Policy "..." always; add_header Permissions-Policy "" always; add_header Referrer-Policy "no-referrer" always; more_set_headers already does that: my bad !
On reverse proxy
proxy_cookie_flags: HttpOnly Secure SameSite=Lax;
Need to test if this override an upper security header. For example, if the reverse app set "SameSite=Strict" will it be applied over "SameSite=Lax" or will it be "SameSite=Lax" that will always be applied ? (SameSite=Strict > SameSite=Lax)
It could be done with
more_set_headers
but sometimes this could lead to a double... secure; secure;
: more_set_headers 'Set-Cookie: $sent_http_set_cookie; secure'; https://unix.stackexchange.com/questions/306463/nginx-add-secure-flag-to-cookies-from-proxied-server or maybe we could try https://github.com/AirisX/nginx_cookie_flag_moduleA missing header
more_set_headers Expect-CT "report-uri=\'\<uri>\', enforce, max-age=\'\<age>\'" always https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT
Content Security Policy is missing default-src 'self', script-src 'self', reflected-xss and upgrade-insecure-requests https://www.keycdn.com/support/content-security-policy