fix(docker): Add security http headers

barnslig · Feb 16, 2022 · b95a817 · b95a817
1 parent dbb4452
commit b95a817
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:14-alpine AS app
+FROM node:16-alpine AS app
 
 COPY app /app
 WORKDIR /app

diff --git a/docker/etc/nginx/sites-enabled/default b/docker/etc/nginx/sites-enabled/default
@@ -4,6 +4,12 @@ server {
 
   root /var/www/html;
 
+  add_header Content-Security-Policy  "default-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none';" always;
+  add_header X-Frame-Options          "DENY" always;
+  add_header X-XSS-Protection         "1; mode=block" always;
+  add_header X-Content-Type-Options   "nosniff" always;
+  add_header Referrer-Policy          "no-referrer" always;
+
   location / {
     try_files $uri $uri/ /index.html;
   }