Closed johanneslamers closed 7 years ago
Yeah so I actually left both of these out on purpose. Not sending the version number just seems "security through obscurity" to me.
The CSP is useful, but can be tricky to get right, and I didn't want to deal with the support :)
haha fair enough. Maybe some commented out examples?
@khalwat Don't blame you... CSP is a PITA.
Yeah I can toss them in and leave them commented out I guess. But I'm sending any support issues to @takobell
Alright, done:
server_tokens off
to disable sending the Nginx version numberContent-Security-Policy
header in security.conf
don't send the nginx version number in error pages and Server header
Add Content-Security-Policy HTTP response header. Helps reduce XSS risks on modern browsers by declaring what dynamic resources are allowed to load via a HTTP Header Need some tweaking, but something like this: