17 lines
1.1 KiB
Plaintext
17 lines
1.1 KiB
Plaintext
# Security headers for the ModelForge operator console.
|
|
#
|
|
# Included in every location because nginx does not inherit `add_header` into a location that
|
|
# declares one of its own — setting them once on the server silently dropped them from the entry
|
|
# document, which is how M16 found this.
|
|
#
|
|
# Generated at image build time from VITE_API_BASE_URL: the console's API origin is compiled into
|
|
# the bundle, so the policy that protects the bundle is derived from the same value rather than
|
|
# maintained separately and allowed to drift.
|
|
add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' __API_ORIGIN__; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|