From 219a79a0de962b7651bafe7e4ee4becefe2094cc Mon Sep 17 00:00:00 2001 From: "Collin M. Barrett" Date: Sat, 23 Jan 2021 15:53:09 -0600 Subject: [PATCH] =?UTF-8?q?fix(reverse-proxy):=20=F0=9F=90=9B=20combine=20?= =?UTF-8?q?add=5Fheader=20directives=20into=20server=20includes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- reverse-proxy/conf.d.dev/default.conf | 1 - reverse-proxy/conf.d/default.conf | 3 +-- reverse-proxy/{loc-includes => svr-includes}/cors.conf | 0 reverse-proxy/svr-includes/csp.conf | 1 + 4 files changed, 2 insertions(+), 3 deletions(-) rename reverse-proxy/{loc-includes => svr-includes}/cors.conf (100%) create mode 100644 reverse-proxy/svr-includes/csp.conf diff --git a/reverse-proxy/conf.d.dev/default.conf b/reverse-proxy/conf.d.dev/default.conf index 22421dd50..9cdbf3b66 100644 --- a/reverse-proxy/conf.d.dev/default.conf +++ b/reverse-proxy/conf.d.dev/default.conf @@ -1,7 +1,6 @@ server { listen 80 default_server; include svr-includes/*; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'none'; frame-ancestors 'none';" always; location ^~ /api/archival/ { rewrite ^/api/archival/(.*)$ /$1 break; diff --git a/reverse-proxy/conf.d/default.conf b/reverse-proxy/conf.d/default.conf index 913027dc9..8a8691eb8 100644 --- a/reverse-proxy/conf.d/default.conf +++ b/reverse-proxy/conf.d/default.conf @@ -4,8 +4,7 @@ server { include svr-includes/*; ssl_certificate /etc/nginx/cert/filterlists_cert.pem; ssl_certificate_key /etc/nginx/cert/filterlists_key.pem; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'none'; frame-ancestors 'none';" always; - + location ^~ /api/archival/ { rewrite ^/api/archival/(.*)$ /$1 break; proxy_pass http://archival-api:80; diff --git a/reverse-proxy/loc-includes/cors.conf b/reverse-proxy/svr-includes/cors.conf similarity index 100% rename from reverse-proxy/loc-includes/cors.conf rename to reverse-proxy/svr-includes/cors.conf diff --git a/reverse-proxy/svr-includes/csp.conf b/reverse-proxy/svr-includes/csp.conf new file mode 100644 index 000000000..673838d27 --- /dev/null +++ b/reverse-proxy/svr-includes/csp.conf @@ -0,0 +1 @@ +add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'none'; frame-ancestors 'none';" always; \ No newline at end of file