From afdbf6eaec6a3e95af874420386c8561d750eeef Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Sun, 11 Oct 2026 01:46:09 -0400 Subject: [PATCH] docs: frame headers in the NPM Advanced template X-Frame-Options DENY and CSP frame-ancestors 'none', inside location / (it has its own add_header, so server-level headers aren't inherited). Live on proxy host 58 since 2026-10-11. Refs #12 Co-Authored-By: Claude Opus 5.5 --- docs/npm-advanced.conf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/npm-advanced.conf b/docs/npm-advanced.conf index 1ed51b4..5b5a17c 100644 --- a/docs/npm-advanced.conf +++ b/docs/npm-advanced.conf @@ -9,7 +9,12 @@ include /snippets/authelia-location.conf; location / { + # Headers go here, not at server level: a location with its own add_header + # (HSTS) doesn't inherit the server's. add_header Strict-Transport-Security $hsts_header always; + # No other site may frame the terminal (clickjacking). + add_header X-Frame-Options "DENY" always; + add_header Content-Security-Policy "frame-ancestors 'none'" always; auth_request /authelia; auth_request_set $user $upstream_http_remote_user;