Add security headers

girleffect · Apr 16, 2024 · 37ac3a5 · 37ac3a5
1 parent 7798a79
commit 37ac3a5
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/nginx/conf.d/django.conf b/nginx/conf.d/django.conf
@@ -12,7 +12,6 @@ upstream gunicorn {
 server {
     server_name {{DOMAIN}};
     server_tokens off;
-
     listen 8000;
 
     root /app;
@@ -49,4 +48,16 @@ server {
         proxy_set_header X-Forwarded-Ssl "";
         proxy_pass http://gunicorn;
     }
+
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header Content-Security-Policy "default-src https: 'self';" always;
+    add_header Referrer-Policy "same-origin" always;
+}
+
+server {
+    listen 8000;
+    server_name ~^www\.(?<domain>.+)$;
+    return 301 https://$domain$request_uri;
 }