Top Posts Tagged with #httpsecurityheaders

NGINX - Access-Control-Allow-Origin - CORS policy settings

Those who often read this blog already know that we're deeply in love with NGINX, a lightweight, high-performance and open-source web server and reverse proxy used by more than 358 million websites and over 66% of the world’s top 10,000 websites. And no, we're not taking money from them to say this, we just happen to like it a lot. Anyway, in this post I'll briefly share the CORS configuration I'm using for the web sites that need to perform Cross Request Resource Sharing activities of any kind - such as using web-fonts from a subdomain on a main domain, or something like that: location / { if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; add_header 'Access-Control-Max-Age' 1728000; add_header 'Content-Type' 'text/plain charset=UTF-8'; add_header 'Content-Length' 0; return 204; } if ($request_method = 'POST') { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; } if ($request_method = 'GET') { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; } } Since it's a pretty long piece of code, you might want to put this on a separate file (such as /etc/nginx/cors-settings.conf ) and then include it with the following one-liner: include /etc/nginx/cors-settings.conf; Pretty neat, isn't it? If you're looking for further info about how to set & configure other NGINX security headers, such as X-Frame-Options, HTTP Strict Transport Security (HSTS), X-XSS-Protection, X-Content-Type-Options, Content Security Policy and Referrer Policy, be sure to check our NGINX HTTP Security Headers guide. Read the full article

#CORS #HTTPHeaders #HTTPSecurityHeaders #Nginx

•18+ Adults Only

Watch Anya Live on Cam

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.

✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality

Anya is LIVE right now

FREE

Free to watch • No registration required • HD streaming

NGINX - How to setup the nginx.conf file to send HTTP Security Headers with your web site (and score an A on securityheaders.io)

We already explained the basics about HTTP Security Headers in this previous post: it's now time to put all these words into action and learn how we can implement them within our Internet Information Services (IIS) instance to shield our valuable web sites from most dangerous threats. In case you need to do that with an Apache web server, read here. The first thing we should do is check our website before making any change, to get a grip of how things currently are. Here are some websites that we can use to scan our web site: securityheaders.io by Scott Helme (blog, twitter). HTTP Security Report by Stefán Orri Stefánsson (twitter). Headers Security Test by Geek Flare Tools (website). Our personal favourite is the first one, as it also has a nice rating system that might help us to understand how protected we are (or not). If your website has no security headers, you'll most likely end up with a severe F rating, just like the following screenshot:

We know, this is our site! We temporarily deactivated everything to be able to get a screenshot that could show the worst possible outcome. If that's your scenario as well, don't worry: you're 1 minute away from ranking up to A ! Without further ado, here's the relevant snippet to place within your Nginx's file: You can place these settings at the http level - if you want them to be applied to all the websites hosted by Nginx - or at the server level of those webserver that you want to protect. In case you choose for the latter, it might be wise to create a separate include.http.headers.conf file to include in the main nginx.conf file with an include statement. That's about it. These settings are loose enough for most web sites while keeping a strong level of security: you shouldn't have issues with any standard website based upon Wordpress, Joomla, Drupal, ASP.NET Core MVC and so on. In case you need a more relaxed content security policy - for example, if you have media, applets or unsafe scripts & styles - you can tweak that specific line. Here's an example accepting basically everything: Don't get us wrong, we're not suggesting using it in any way! However, whenever a given scenario would force us to accept anything, having a super-permissive policy it's still better than having none. And here's our scan after implementing all of the above:

That's it! If you need to do that with Apache, read here; to do that with IIS, read here. I sincerely hope that this post will help you to improve the security level of your web site as well. This post is part of a series of articles, tutorials and guides on the NGINX web server & reverse proxy. To read the other posts, click here! Read the full article

#HTTP #HTTPSecurityHeaders #Nginx