From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH 3/4] httpd: apply the same security headers on the captive portal instance as we do elsewhere Date: Mon, 12 Apr 2021 23:01:13 +0200 Message-ID: <5251bce1-49af-64e5-a858-5e33210d9e6b@ipfire.org> In-Reply-To: <8698f06c-19c9-1680-f179-4d50c00bed1a@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3654440353595886558==" List-Id: --===============3654440353595886558== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The Captive Portal should not be framed or leak sensitive detail via Referrers either. Signed-off-by: Peter M=C3=BCller --- config/httpd/vhosts.d/captive.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/httpd/vhosts.d/captive.conf b/config/httpd/vhosts.d/capti= ve.conf index 629fa8180..51af6eac4 100644 --- a/config/httpd/vhosts.d/captive.conf +++ b/config/httpd/vhosts.d/captive.conf @@ -11,6 +11,8 @@ Listen 1013 =20 Header always set X-Content-Type-Options nosniff Header always set Content-Security-Policy "default-src 'self'; script-src '= self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" + Header always set Referrer-Policy strict-origin + Header always set X-Frame-Options sameorigin =20 ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/captive/ Alias /assets/ /srv/web/ipfire/html/captive/assets/ --=20 2.26.2 --===============3654440353595886558==--