This is an automated email from the ASF dual-hosted git repository. fanningpj pushed a commit to branch security-headers in repository https://gitbox.apache.org/repos/asf/incubator-pekko-site.git
commit a74d0ca0eaae13bea8b481a445a48a1bfa105f90 Author: PJ Fanning <[email protected]> AuthorDate: Wed Feb 21 23:30:02 2024 +0100 add security headers --- content/.htaccess | 8 ++++++++ src/main/public/.htaccess | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/content/.htaccess b/content/.htaccess index 2a9de340..66f21ff3 100644 --- a/content/.htaccess +++ b/content/.htaccess @@ -55,3 +55,11 @@ RewriteRule ^japi/([^/]+)/1.0.2/(.*)$ https://nightlies.apache.org/pekko/docs/$1 RewriteRule ^docs/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/docs/$2 [P] RewriteRule ^api/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/api/$2 [P] RewriteRule ^japi/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/japi/$2 [P] + +# Security Headers +Header set Strict-Transport-Security "max-age=31536000" +Header set Content-Security-Policy "default-src 'self' https://api.github.com/ https://pekko.apache.org/ ; style-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; script-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; frame-src 'self' ;" +Header always set X-Frame-Options SAMEORIGIN +Header set X-Content-Type-Options nosniff +Header set X-XSS-Protection "1; mode=block" +Header set Referrer-Policy: strict-origin diff --git a/src/main/public/.htaccess b/src/main/public/.htaccess index 2a9de340..66f21ff3 100644 --- a/src/main/public/.htaccess +++ b/src/main/public/.htaccess @@ -55,3 +55,11 @@ RewriteRule ^japi/([^/]+)/1.0.2/(.*)$ https://nightlies.apache.org/pekko/docs/$1 RewriteRule ^docs/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/docs/$2 [P] RewriteRule ^api/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/api/$2 [P] RewriteRule ^japi/([^/]+)/1.0/(.*)$ https://nightlies.apache.org/pekko/docs/$1/1.0/japi/$2 [P] + +# Security Headers +Header set Strict-Transport-Security "max-age=31536000" +Header set Content-Security-Policy "default-src 'self' https://api.github.com/ https://pekko.apache.org/ ; style-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; script-src 'self' https://pekko.apache.org/ 'unsafe-inline' ; frame-src 'self' ;" +Header always set X-Frame-Options SAMEORIGIN +Header set X-Content-Type-Options nosniff +Header set X-XSS-Protection "1; mode=block" +Header set Referrer-Policy: strict-origin --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
