mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
1f8fc336e6
#1115 raised HSTS to one year but set no X-Content-Type-Options, Referrer-Policy, Permissions-Policy or HSTS includeSubDomains/preload, because none of them is safe globally: nosniff lets ORB block no-cors responses typed text/html, includeSubDomains on the apex covers hosts the platform does not serve, and a server-level add_header is dropped in every location that sets its own. WEBSERVER_SECURITY_HEADERS (group_vars/all/04_webserver.yml) now holds the platform values, all opt-in: nosniff false, no Referrer-Policy, no Permissions-Policy, HSTS max-age one year without includeSubDomains or preload. A role overrides any key under security_headers in its meta/server.yml, an inventory under applications.<role>.server.security_headers. The new security_headers filter merges both, rejects unknown keys, wrong types, unknown Referrer-Policy tokens, non-printable header values and preload without includeSubDomains or below a one-year max-age, and composes the HSTS value. - nosniff, Referrer-Policy and Permissions-Policy are set in the Lua header filter of content_security_policy.conf.j2, next to CSP, so a location's own add_header cannot drop them. Referrer-Policy is only set when the upstream sends none; Permissions-Policy only on HTML documents. - HSTS stays the single server-level add_header in nginx_ssl_header.j2, now with the per-app value. A second emitter in Lua would duplicate the header. It stays inside the TLS branch, which onion vhosts never enter, so an onion vhost gets no HSTS even when its app opts in. No role opts in yet, so rendered vhosts are unchanged. Closes #1123 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
15 lines
597 B
Django/Jinja
15 lines
597 B
Django/Jinja
{% set _security_headers = lookup('applications') | security_headers(application_id, WEBSERVER_SECURITY_HEADERS) %}
|
|
{% if _security_headers.nosniff %}
|
|
ngx.header["X-Content-Type-Options"] = "nosniff"
|
|
{% endif %}
|
|
{% if _security_headers.referrer_policy %}
|
|
if not ngx.header["Referrer-Policy"] then
|
|
ngx.header["Referrer-Policy"] = {{ _security_headers.referrer_policy | to_json }}
|
|
end
|
|
{% endif %}
|
|
{% if _security_headers.permissions_policy %}
|
|
if is_html then
|
|
ngx.header["Permissions-Policy"] = {{ _security_headers.permissions_policy | to_json }}
|
|
end
|
|
{% endif %}
|