LotusGuild/devdesk
2
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases 28 Wiki Activity

docs: frame headers in the NPM Advanced template
build-deb / Lint, test, package (push) Successful in 2m44s
Details
build-deb / Deploy to CT 126 (push) Skipped
Details
build-deb / Notify on failure (push) Skipped
Details

Browse Source 
X-Frame-Options DENY and CSP frame-ancestors 'none', inside location /
(it has its own add_header, so server-level headers aren't inherited).
Live on proxy host 58 since 2026-10-11.

Refs #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
jared
2026-10-11 01:46:09 -04:00
co-authored by Claude Opus 5.5
parent 74927a7640
commit afdbf6eaec
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/npm-advanced.conf
+5
View File
@@ -9,7 +9,12 @@
include /snippets/authelia-location.conf; include /snippets/authelia-location.conf;
location / { location / {
# Headers go here, not at server level: a location with its own add_header
# (HSTS) doesn't inherit the server's.
add_header Strict-Transport-Security $hsts_header always; add_header Strict-Transport-Security $hsts_header always;
# No other site may frame the terminal (clickjacking).
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "frame-ancestors 'none'" always;
auth_request /authelia; auth_request /authelia;
auth_request_set $user $upstream_http_remote_user; auth_request_set $user $upstream_http_remote_user;