From aaae7ad92e46d57aad780c7468a0d27def7c6803 Mon Sep 17 00:00:00 2001 From: Louis Matthijssen Date: Sun, 9 Sep 2018 21:33:35 +0200 Subject: [PATCH 1/2] Set Referrer-Policy header for nginx installation docs --- admin_manual/installation/nginx.rst | 2 ++ 1 file changed, 2 insertions(+) diff --git a/admin_manual/installation/nginx.rst b/admin_manual/installation/nginx.rst index a24a31bf3..64c85c08e 100644 --- a/admin_manual/installation/nginx.rst +++ b/admin_manual/installation/nginx.rst @@ -74,6 +74,7 @@ webroot of your nginx installation. In this example it is add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; + add_header Referrer-Policy no-referrer; # Remove X-Powered-By, which is an information leak fastcgi_hide_header X-Powered-By; @@ -219,6 +220,7 @@ your nginx installation. add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; + add_header Referrer-Policy no-referrer; # Remove X-Powered-By, which is an information leak fastcgi_hide_header X-Powered-By; From f70574fabe5513832a53ec4554607225f529eacd Mon Sep 17 00:00:00 2001 From: Tilo Spannagel Date: Tue, 11 Sep 2018 15:03:38 +0200 Subject: [PATCH 2/2] Add Referrer-Policy header to second location Signed-off-by: Tilo Spannagel --- admin_manual/installation/nginx.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/admin_manual/installation/nginx.rst b/admin_manual/installation/nginx.rst index 64c85c08e..32822f362 100644 --- a/admin_manual/installation/nginx.rst +++ b/admin_manual/installation/nginx.rst @@ -168,6 +168,8 @@ webroot of your nginx installation. In this example it is add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; + add_header Referrer-Policy no-referrer; + # Optional: Don't log access to assets access_log off; } @@ -314,6 +316,8 @@ your nginx installation. add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; + add_header Referrer-Policy no-referrer; + # Optional: Don't log access to assets access_log off; }