Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/nextcloud/server.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLukas Reschke <lukas@owncloud.com>2015-01-19 13:56:04 +0300
committerLukas Reschke <lukas@owncloud.com>2015-03-02 21:07:46 +0300
commitbbd5f2841561911461d992483cab54f5c18fa342 (patch)
tree113e9ab1919c8fb42a7fd90db79139b783a643c9 /.htaccess
parent1155ad6e389e47e110a415f22eddda1570dc9ff2 (diff)
Let users configure security headers in their Webserver
Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
Diffstat (limited to '.htaccess')
-rw-r--r--.htaccess4
1 files changed, 4 insertions, 0 deletions
diff --git a/.htaccess b/.htaccess
index d79ee9f8871..5e24a35743d 100644
--- a/.htaccess
+++ b/.htaccess
@@ -45,6 +45,10 @@ Options -Indexes
ModPagespeed Off
</IfModule>
<IfModule mod_headers.c>
+ Header set X-Content-Type-Options "nosniff"
+ Header set X-XSS-Protection "1; mode=block"
+ Header set X-Robots-Tag "none"
+ Header set X-Frame-Options "SAMEORIGIN"
<FilesMatch "\.(css|js)$">
Header set Cache-Control "max-age=7200, public"
</FilesMatch>