81a28142a0
Adds the following headers as static:
X-Content-Type-Options "nosniff"
X-XSS-Protection "1; mode=block"
append Content-Security-Policy "default-src 'self' https: wss:;"
nosniff prevents non-executable mime times from becoming executable.
The X-XSS-Protection header will prevent the loading of a page if the
browser detects an xss attack. The Content-Security-Policy declares
what dynamic resources are allowed to load.
Adds the following header as user-setable via the
keystone_x_frame_options variable.
X-Frame-Options "DENY"
By default the X-Frame-Options header denies embedding in an iframe.
Change-Id: Iadd3e93bdb7e9d41ae1d027196367448dbce19f1
Partial-Bug: 1717321
43 lines
1.4 KiB
Django/Jinja
43 lines
1.4 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
server {
|
|
|
|
listen {{ keystone_nginx_ports[item] }};
|
|
|
|
{% if keystone_ssl | bool and keystone_service_adminuri_proto == "https" %}
|
|
ssl on;
|
|
ssl_protocols {{ keystone_ssl_protocol }};
|
|
ssl_certificate {{ keystone_ssl_cert }};
|
|
ssl_certificate_key {{ keystone_ssl_key }};
|
|
ssl_trusted_certificate {{ keystone_ssl_ca_cert }};
|
|
ssl_ciphers {{ keystone_ssl_cipher_suite }};
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_session_cache shared:SSL:2m;
|
|
ssl_session_timeout 2m;
|
|
{%- endif %}
|
|
|
|
{% for line in keystone_nginx_extra_conf %}
|
|
{{ line }}
|
|
{%- endfor %}
|
|
|
|
access_log /var/log/nginx/{{ item }}-access.log custom;
|
|
error_log /var/log/nginx/{{ item }}-error.log info;
|
|
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
add_header Content-Security-Policy "default-src 'self' https: wss:;";
|
|
add_header X-Frame-Options {{ keystone_x_frame_options | default ('DENY') }};
|
|
|
|
location / {
|
|
try_files $uri @yourapplication;
|
|
}
|
|
|
|
location @yourapplication {
|
|
include uwsgi_params;
|
|
uwsgi_pass 127.0.0.1:{{ keystone_uwsgi_ports[item]['socket'] }};
|
|
uwsgi_param SCRIPT_NAME '';
|
|
{% for header in keystone_extra_headers %}
|
|
add_header "{{ header['parameter'] }}" "{{ header['value'] }}";
|
|
{% endfor %}
|
|
}
|
|
}
|