You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pekko.apache.org by fa...@apache.org on 2024/02/21 22:30:13 UTC
(incubator-pekko-site) 01/01: add security headers
This is an automated email from the ASF dual-hosted git repository.
fanningpj pushed a commit to branch security-headers
in repository https://gitbox.apache.org/repos/asf/incubator-pekko-site.git
commit a74d0ca0eaae13bea8b481a445a48a1bfa105f90
Author: PJ Fanning <pj...@users.noreply.github.com>
AuthorDate: Wed Feb 21 23:30:02 2024 +0100
add security headers
---
content/.htaccess | 8 ++++++++
src/main/public/.htaccess | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git a/content/.htaccess b/content/.htaccess
index 2a9de340..66f21ff3 100644
--- a/content/.htaccess
+++ b/content/.htaccess
@@ -55,3 +55,11 @@ RewriteRule ^japi/([^/]+)/1.0.2/(.*)$ https://nightlies.apache.org/pekko/docs/$1
RewriteRule ^docs/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/docs/$2 [P]
RewriteRule ^api/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/api/$2 [P]
RewriteRule ^japi/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/japi/$2 [P]
+
+# Security Headers
+Header set Strict-Transport-Security "max-age=31536000"
+Header set Content-Security-Policy "default-src 'self' https://api.github.com/ https://pekko.apache.org/ ; style-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; script-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; frame-src 'self' ;"
+Header always set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Referrer-Policy: strict-origin
diff --git a/src/main/public/.htaccess b/src/main/public/.htaccess
index 2a9de340..66f21ff3 100644
--- a/src/main/public/.htaccess
+++ b/src/main/public/.htaccess
@@ -55,3 +55,11 @@ RewriteRule ^japi/([^/]+)/1.0.2/(.*)$ https://nightlies.apache.org/pekko/docs/$1
RewriteRule ^docs/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/docs/$2 [P]
RewriteRule ^api/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/api/$2 [P]
RewriteRule ^japi/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/japi/$2 [P]
+
+# Security Headers
+Header set Strict-Transport-Security "max-age=31536000"
+Header set Content-Security-Policy "default-src 'self' https://api.github.com/ https://pekko.apache.org/ ; style-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; script-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; frame-src 'self' ;"
+Header always set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Referrer-Policy: strict-origin
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pekko.apache.org
For additional commands, e-mail: commits-help@pekko.apache.org