merge #755 - Prevent click jacking of the management interface

2016-03-23 16:53:48 -04:00 · 2016-03-23 16:53:48 -04:00 · 3d4cabbcd5
parent cdedaed3b0 44705a32b7
commit 3d4cabbcd5
1 changed files with 3 additions and 0 deletions
--- a/conf/nginx-primaryonly.conf
+++ b/conf/nginx-primaryonly.conf
@ -6,6 +6,9 @@
 	location /admin/ {
 		proxy_pass http://127.0.0.1:10222/;
 		proxy_set_header X-Forwarded-For $remote_addr;
+		add_header X-Frame-Options "DENY";
+		add_header X-Content-Type-Options nosniff;
+		add_header Content-Security-Policy "frame-ancestors 'none';";
 	}

 	# ownCloud configuration.