aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--www/h2o-devel/files/h2o.conf.sample.in16
-rw-r--r--www/h2o/files/h2o.conf.sample.in16
2 files changed, 16 insertions, 16 deletions
diff --git a/www/h2o-devel/files/h2o.conf.sample.in b/www/h2o-devel/files/h2o.conf.sample.in
index d8d61f6de9e4..38c703f3a938 100644
--- a/www/h2o-devel/files/h2o.conf.sample.in
+++ b/www/h2o-devel/files/h2o.conf.sample.in
@@ -29,15 +29,15 @@ listen:
cipher-suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
# A+ on https://securityheaders.io/
-header.add: "x-frame-options: deny"
-header.add: "X-XSS-Protection: 1; mode=block"
-header.add: "X-Content-Type-Options: nosniff"
-header.add: "X-UA-Compatible: IE=Edge"
-header.add: "Referrer-Policy: strict-origin"
-header.add: "Cache-Control: no-transform"
-header.add: "Content-Security-Policy: default-src https:"
+header.set: "x-frame-options: deny"
+header.set: "X-XSS-Protection: 1; mode=block"
+header.set: "X-Content-Type-Options: nosniff"
+header.set: "X-UA-Compatible: IE=Edge"
+header.set: "Referrer-Policy: strict-origin"
+header.set: "Cache-Control: no-transform"
+header.set: "Content-Security-Policy: default-src https:"
# 6 months HSTS pinning
-header.add: "Strict-Transport-Security: max-age=16000000"
+header.set: "Strict-Transport-Security: max-age=16000000"
# limit POST bodies
limit-request-body: 10485760 # 10MiB
diff --git a/www/h2o/files/h2o.conf.sample.in b/www/h2o/files/h2o.conf.sample.in
index d8d61f6de9e4..38c703f3a938 100644
--- a/www/h2o/files/h2o.conf.sample.in
+++ b/www/h2o/files/h2o.conf.sample.in
@@ -29,15 +29,15 @@ listen:
cipher-suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
# A+ on https://securityheaders.io/
-header.add: "x-frame-options: deny"
-header.add: "X-XSS-Protection: 1; mode=block"
-header.add: "X-Content-Type-Options: nosniff"
-header.add: "X-UA-Compatible: IE=Edge"
-header.add: "Referrer-Policy: strict-origin"
-header.add: "Cache-Control: no-transform"
-header.add: "Content-Security-Policy: default-src https:"
+header.set: "x-frame-options: deny"
+header.set: "X-XSS-Protection: 1; mode=block"
+header.set: "X-Content-Type-Options: nosniff"
+header.set: "X-UA-Compatible: IE=Edge"
+header.set: "Referrer-Policy: strict-origin"
+header.set: "Cache-Control: no-transform"
+header.set: "Content-Security-Policy: default-src https:"
# 6 months HSTS pinning
-header.add: "Strict-Transport-Security: max-age=16000000"
+header.set: "Strict-Transport-Security: max-age=16000000"
# limit POST bodies
limit-request-body: 10485760 # 10MiB