From 474383d17b96d4d03c068b59d788cb8db5a433e6 Mon Sep 17 00:00:00 2001 From: thomas Date: Tue, 25 Aug 2026 08:12:15 +0200 Subject: [PATCH] =?UTF-8?q?fix(nginx):=20Security-Header=20in=20=C3=BCbers?= =?UTF-8?q?chreibenden=20location-Bl=C3=B6cken=20wiederholen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nginx vererbt add_header nicht in Blöcke, die eigene add_header setzen. Dadurch gingen X-Frame-Options, X-Content-Type-Options und X-XSS-Protection ausgerechnet bei den HTML-Antworten verloren – jeder location-Block mit Cache-Control hat sie stillschweigend abgeschaltet. Verifiziert: nginx -t ist für alle drei Konfigurationen erfolgreich. Co-Authored-By: Claude Opus 5 --- drohnenfuehrer/frontend/nginx.conf | 29 ++++++++++++++++++++++++++++- nachsuche/frontend/nginx.conf | 29 ++++++++++++++++++++++++++++- stoeberhunde/frontend/nginx.conf | 29 ++++++++++++++++++++++++++++- 3 files changed, 84 insertions(+), 3 deletions(-) diff --git a/drohnenfuehrer/frontend/nginx.conf b/drohnenfuehrer/frontend/nginx.conf index 78e1a5b..fc141ff 100644 --- a/drohnenfuehrer/frontend/nginx.conf +++ b/drohnenfuehrer/frontend/nginx.conf @@ -27,19 +27,28 @@ server { gzip_types text/plain text/xml application/xml+rss application/json; gzip_disable "msie6"; - # Security headers + # Security headers. + # ACHTUNG: nginx vererbt add_header nicht in Bloecke, die eigene add_header + # setzen - deshalb sind diese drei Zeilen in jedem solchen location-Block + # wiederholt. Beim Anlegen neuer Bloecke mit add_header daran denken. add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; # Cache static assets (images, fonts) location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; expires 1y; add_header Cache-Control "public, immutable"; } # JS and CSS - no compression, short cache location ~* \.(js|css)$ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; expires 1h; add_header Cache-Control "public, no-transform"; gzip off; @@ -47,6 +56,9 @@ server { # Service Worker - never cache location = /sw.js { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; expires 0; } @@ -79,6 +91,9 @@ server { # Service Worker for subpath deployment location = /drohnenfuehrer/sw.js { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; expires 0; alias /usr/share/nginx/html/sw.js; @@ -86,6 +101,9 @@ server { # index.html - never cache so new builds are picked up immediately location = /index.html { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; add_header Pragma "no-cache"; expires 0; @@ -93,6 +111,9 @@ server { # SPA fallback for subpath deployment (/drohnenfuehrer) location ^~ /drohnenfuehrer/ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; rewrite ^/drohnenfuehrer(/.*)$ $1 break; try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache, no-store, must-revalidate"; @@ -102,6 +123,9 @@ server { # SPA fallback - serve index.html for all routes location / { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache, no-store, must-revalidate"; add_header Pragma "no-cache"; @@ -110,6 +134,9 @@ server { # Health check endpoint location /health { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; access_log off; return 200 "OK\n"; add_header Content-Type text/plain; diff --git a/nachsuche/frontend/nginx.conf b/nachsuche/frontend/nginx.conf index b1ca210..edeb4d3 100644 --- a/nachsuche/frontend/nginx.conf +++ b/nachsuche/frontend/nginx.conf @@ -27,19 +27,28 @@ server { gzip_types text/plain text/xml application/xml+rss application/json; gzip_disable "msie6"; - # Security headers + # Security headers. + # ACHTUNG: nginx vererbt add_header nicht in Bloecke, die eigene add_header + # setzen - deshalb sind diese drei Zeilen in jedem solchen location-Block + # wiederholt. Beim Anlegen neuer Bloecke mit add_header daran denken. add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; # Cache static assets (images, fonts) location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; expires 1y; add_header Cache-Control "public, immutable"; } # JS and CSS - no compression, short cache location ~* \.(js|css)$ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; expires 1h; add_header Cache-Control "public, no-transform"; gzip off; @@ -47,6 +56,9 @@ server { # Service Worker - never cache location = /sw.js { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; expires 0; } @@ -79,6 +91,9 @@ server { # Service Worker for subpath deployment location = /nachsuche/sw.js { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; expires 0; alias /usr/share/nginx/html/sw.js; @@ -86,6 +101,9 @@ server { # index.html - never cache so new builds are picked up immediately location = /index.html { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; add_header Pragma "no-cache"; expires 0; @@ -93,6 +111,9 @@ server { # SPA fallback for subpath deployment (/nachsuche) location ^~ /nachsuche/ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; rewrite ^/nachsuche(/.*)$ $1 break; try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache, no-store, must-revalidate"; @@ -102,6 +123,9 @@ server { # SPA fallback - serve index.html for all routes location / { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache, no-store, must-revalidate"; add_header Pragma "no-cache"; @@ -110,6 +134,9 @@ server { # Health check endpoint location /health { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; access_log off; return 200 "OK\n"; add_header Content-Type text/plain; diff --git a/stoeberhunde/frontend/nginx.conf b/stoeberhunde/frontend/nginx.conf index 864f20d..a4bd1d7 100644 --- a/stoeberhunde/frontend/nginx.conf +++ b/stoeberhunde/frontend/nginx.conf @@ -27,19 +27,28 @@ server { gzip_types text/plain text/xml application/xml+rss application/json; gzip_disable "msie6"; - # Security headers + # Security headers. + # ACHTUNG: nginx vererbt add_header nicht in Bloecke, die eigene add_header + # setzen - deshalb sind diese drei Zeilen in jedem solchen location-Block + # wiederholt. Beim Anlegen neuer Bloecke mit add_header daran denken. add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; # Cache static assets (images, fonts) location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; expires 1y; add_header Cache-Control "public, immutable"; } # JS and CSS - no compression, short cache location ~* \.(js|css)$ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; expires 1h; add_header Cache-Control "public, no-transform"; gzip off; @@ -47,6 +56,9 @@ server { # Service Worker - never cache location = /sw.js { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; expires 0; } @@ -79,6 +91,9 @@ server { # Service Worker for subpath deployment location = /stoeberhunde/sw.js { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; expires 0; alias /usr/share/nginx/html/sw.js; @@ -86,6 +101,9 @@ server { # index.html - never cache so new builds are picked up immediately location = /index.html { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "no-cache, no-store, must-revalidate"; add_header Pragma "no-cache"; expires 0; @@ -93,6 +111,9 @@ server { # SPA fallback for subpath deployment (/stoeberhunde) location ^~ /stoeberhunde/ { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; rewrite ^/stoeberhunde(/.*)$ $1 break; try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache, no-store, must-revalidate"; @@ -102,6 +123,9 @@ server { # SPA fallback - serve index.html for all routes location / { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache, no-store, must-revalidate"; add_header Pragma "no-cache"; @@ -110,6 +134,9 @@ server { # Health check endpoint location /health { + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; access_log off; return 200 "OK\n"; add_header Content-Type text/plain;