diff --git a/conf/nginx.conf b/conf/nginx.conf index f07531d..eb2e105 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -4,7 +4,7 @@ set $allowed_origins "https://${sandbox_domain}"; set $api_domain "__DOMAIN__"; set $files_domain "__DOMAIN__"; ssl_ecdh_curve secp384r1; -more_set_headers "Strict-Transport-Security: 'max-age=31536000; includeSubDomains' always"; +more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains; always"; more_set_headers "X-XSS-Protection: '1; mode=block'"; more_set_headers "X-Content-Type-Options: nosniff"; more_set_headers "Access-Control-Allow-Origin: '${allowed_origins}'";