237899745/vue-driven-cloud-storage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: deduplicate proxied security headers

Browse Source
This commit is contained in:
237899745
2026-07-27 13:45:22 +08:00
parent 6b7b79c7cb
commit f760aa0ae9
4 changed files with 87 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
nginx/nginx.conf
View File

@@ -13,6 +13,16 @@ server {
add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' blob: https:; connect-src 'self' https: ws: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self';" always;
# 对外安全头由 Nginx 统一输出，避免与后端重复
proxy_hide_header X-Frame-Options;
proxy_hide_header X-Content-Type-Options;
proxy_hide_header X-XSS-Protection;
proxy_hide_header Referrer-Policy;
proxy_hide_header Permissions-Policy;
proxy_hide_header Strict-Transport-Security;
proxy_hide_header X-Request-ID;
proxy_hide_header Content-Security-Policy;
# 隐藏Nginx版本
server_tokens off;

10
nginx/nginx.conf.example
View File

@@ -52,6 +52,16 @@ server {
add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' blob: https:; connect-src 'self' https: ws: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self';" always;
# 对外安全头由 Nginx 统一输出，避免与后端重复
proxy_hide_header X-Frame-Options;
proxy_hide_header X-Content-Type-Options;
proxy_hide_header X-XSS-Protection;
proxy_hide_header Referrer-Policy;
proxy_hide_header Permissions-Policy;
proxy_hide_header Strict-Transport-Security;
proxy_hide_header X-Request-ID;
proxy_hide_header Content-Security-Policy;
# 隐藏 Nginx 版本
server_tokens off;