Hi,
I would like to add http header on Ngnix configuration :
X-XSS-Protection: 1; mode=block
Cache-Control: no-store
Cache-Control: public, max-age=604800
Cache-Control: private, max-age=604800
I didn't found them on documentation chef-server.rb Optional Settings
Do you know how I can do this ?
OS
Distributor ID: CentOS
Release: 7.6.1810
Chef
chef-server-ctl version
15.5.1
# chef-server-ctl status
run: bookshelf: (pid 101251) 2042s; run: log: (pid 20599) 12640163s
run: nginx: (pid 101359) 2042s; run: log: (pid 20601) 12640163s
run: oc_bifrost: (pid 101367) 2041s; run: log: (pid 20597) 12640163s
run: oc_id: (pid 101438) 2041s; run: log: (pid 20611) 12640163s
run: opensearch: (pid 101480) 2040s; run: log: (pid 20595) 12640163s
run: opscode-erchef: (pid 101536) 2040s; run: log: (pid 20613) 12640163s
run: postgresql: (pid 101630) 2040s; run: log: (pid 20598) 12640163s
run: redis_lb: (pid 101716) 2039s; run: log: (pid 20604) 12640163s
The headers :
$ curl -i https://CHEFSERVER_URL
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 13:31:04 GMT
Content-Type: text/html
Content-Length: 1749
Last-Modified: Mon, 27 Feb 2023 11:22:16 GMT
Connection: keep-alive
ETag: "63fc9268-6d5"
Content-Security-Policy: default-src 'self';
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Permissions-Policy: camera=(); payment=(); microphone=(); gyroscope=(); magnetometer=(); midi=(); geolocation=()
Referrer-Policy: strict-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes