diff options
| author | Dave Cottlehuber <dch@FreeBSD.org> | 2020-10-09 21:00:14 +0000 |
|---|---|---|
| committer | Dave Cottlehuber <dch@FreeBSD.org> | 2020-10-09 21:00:14 +0000 |
| commit | dbb6475931b14d810bca42075810c4cb56409490 (patch) | |
| tree | 50029bfaf8bb1c31c2829b5f1b7bb8649ed82a59 | |
| parent | 5fb59d55d0e3e9c4581bd926225891a31a9a8650 (diff) | |
| download | ports-dbb6475931b14d810bca42075810c4cb56409490.tar.gz ports-dbb6475931b14d810bca42075810c4cb56409490.zip | |
www/h2o*: set default http headers in samples, not add
This improves the default security posture of both h2o-flavoured ports.
Submitted by: Uwe Trenkner <uwe@trenknerconsulting.com>
Sponsored by: SkunkWerks, GmbH
Notes
Notes:
svn path=/head/; revision=551826
| -rw-r--r-- | www/h2o-devel/files/h2o.conf.sample.in | 16 | ||||
| -rw-r--r-- | www/h2o/files/h2o.conf.sample.in | 16 |
2 files changed, 16 insertions, 16 deletions
diff --git a/www/h2o-devel/files/h2o.conf.sample.in b/www/h2o-devel/files/h2o.conf.sample.in index d8d61f6de9e4..38c703f3a938 100644 --- a/www/h2o-devel/files/h2o.conf.sample.in +++ b/www/h2o-devel/files/h2o.conf.sample.in @@ -29,15 +29,15 @@ listen: cipher-suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS # A+ on https://securityheaders.io/ -header.add: "x-frame-options: deny" -header.add: "X-XSS-Protection: 1; mode=block" -header.add: "X-Content-Type-Options: nosniff" -header.add: "X-UA-Compatible: IE=Edge" -header.add: "Referrer-Policy: strict-origin" -header.add: "Cache-Control: no-transform" -header.add: "Content-Security-Policy: default-src https:" +header.set: "x-frame-options: deny" +header.set: "X-XSS-Protection: 1; mode=block" +header.set: "X-Content-Type-Options: nosniff" +header.set: "X-UA-Compatible: IE=Edge" +header.set: "Referrer-Policy: strict-origin" +header.set: "Cache-Control: no-transform" +header.set: "Content-Security-Policy: default-src https:" # 6 months HSTS pinning -header.add: "Strict-Transport-Security: max-age=16000000" +header.set: "Strict-Transport-Security: max-age=16000000" # limit POST bodies limit-request-body: 10485760 # 10MiB diff --git a/www/h2o/files/h2o.conf.sample.in b/www/h2o/files/h2o.conf.sample.in index d8d61f6de9e4..38c703f3a938 100644 --- a/www/h2o/files/h2o.conf.sample.in +++ b/www/h2o/files/h2o.conf.sample.in @@ -29,15 +29,15 @@ listen: cipher-suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS # A+ on https://securityheaders.io/ -header.add: "x-frame-options: deny" -header.add: "X-XSS-Protection: 1; mode=block" -header.add: "X-Content-Type-Options: nosniff" -header.add: "X-UA-Compatible: IE=Edge" -header.add: "Referrer-Policy: strict-origin" -header.add: "Cache-Control: no-transform" -header.add: "Content-Security-Policy: default-src https:" +header.set: "x-frame-options: deny" +header.set: "X-XSS-Protection: 1; mode=block" +header.set: "X-Content-Type-Options: nosniff" +header.set: "X-UA-Compatible: IE=Edge" +header.set: "Referrer-Policy: strict-origin" +header.set: "Cache-Control: no-transform" +header.set: "Content-Security-Policy: default-src https:" # 6 months HSTS pinning -header.add: "Strict-Transport-Security: max-age=16000000" +header.set: "Strict-Transport-Security: max-age=16000000" # limit POST bodies limit-request-body: 10485760 # 10MiB |