This is an automated email from the ASF dual-hosted git repository.
engelen pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-pekko-site.git
The following commit(s) were added to refs/heads/main by this push:
new d8c202d3 add security headers (#86)
d8c202d3 is described below
commit d8c202d32ce0542b730f6c8e0405720457adaf62
Author: PJ Fanning <[email protected]>
AuthorDate: Thu Feb 22 10:21:19 2024 +0100
add security headers (#86)
* add security headers
* add comment
---
content/.htaccess | 9 +++++++++
src/main/public/.htaccess | 9 +++++++++
2 files changed, 18 insertions(+)
diff --git a/content/.htaccess b/content/.htaccess
index 2a9de340..91566677 100644
--- a/content/.htaccess
+++ b/content/.htaccess
@@ -55,3 +55,12 @@ RewriteRule ^japi/([^/]+)/1.0.2/(.*)$
https://nightlies.apache.org/pekko/docs/$1
RewriteRule ^docs/([^/]+)/1.0/(.*)$
https://nightlies.apache.org/pekko/docs/$1/1.0/docs/$2 [P]
RewriteRule ^api/([^/]+)/1.0/(.*)$
https://nightlies.apache.org/pekko/docs/$1/1.0/api/$2 [P]
RewriteRule ^japi/([^/]+)/1.0/(.*)$
https://nightlies.apache.org/pekko/docs/$1/1.0/japi/$2 [P]
+
+# Security Headers
+Header set Strict-Transport-Security "max-age=31536000"
+# https://github.com/apache/incubator-pekko-sbt-paradox/issues/110 is open for
https://api.github.com/
+Header set Content-Security-Policy "default-src 'self' https://api.github.com/
https://pekko.apache.org/ ; style-src 'self' https://pekko.apache.org/
'unsafe-inline' ; script-src 'self' https://pekko.apache.org/ 'unsafe-inline' ;
frame-src 'self' ;"
+Header always set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Referrer-Policy: strict-origin
diff --git a/src/main/public/.htaccess b/src/main/public/.htaccess
index 2a9de340..91566677 100644
--- a/src/main/public/.htaccess
+++ b/src/main/public/.htaccess
@@ -55,3 +55,12 @@ RewriteRule ^japi/([^/]+)/1.0.2/(.*)$
https://nightlies.apache.org/pekko/docs/$1
RewriteRule ^docs/([^/]+)/1.0/(.*)$
https://nightlies.apache.org/pekko/docs/$1/1.0/docs/$2 [P]
RewriteRule ^api/([^/]+)/1.0/(.*)$
https://nightlies.apache.org/pekko/docs/$1/1.0/api/$2 [P]
RewriteRule ^japi/([^/]+)/1.0/(.*)$
https://nightlies.apache.org/pekko/docs/$1/1.0/japi/$2 [P]
+
+# Security Headers
+Header set Strict-Transport-Security "max-age=31536000"
+# https://github.com/apache/incubator-pekko-sbt-paradox/issues/110 is open for
https://api.github.com/
+Header set Content-Security-Policy "default-src 'self' https://api.github.com/
https://pekko.apache.org/ ; style-src 'self' https://pekko.apache.org/
'unsafe-inline' ; script-src 'self' https://pekko.apache.org/ 'unsafe-inline' ;
frame-src 'self' ;"
+Header always set X-Frame-Options SAMEORIGIN
+Header set X-Content-Type-Options nosniff
+Header set X-XSS-Protection "1; mode=block"
+Header set Referrer-Policy: strict-origin
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
