0

I'm trying to have the nginx on my Elastic Beanstalk application add some headers to every response.

I've edited my 00_application.conf file (in .ebextensions/nginx/conf.d/elasticbeanstalk) to include:

location / {
     # snip other config
     proxy_set_header    Strict-Transport-Security "max-age=86400; includeSubDomains";
     proxy_set_header    Referrer-Policy           "no-referrer";
     proxy_set_header    Content-Security-Policy   "default-src 'none'";
     proxy_set_header    X-Content-Type-Options    "nosniff";
     proxy_set_header    X-Frame-Options           "deny";
     proxy_set_header    X-XSS-Protection          "0";
}

However, when I make a request, only some of these headers are coming through: I'm seeing the X-Frame-Options: DENY and X-Content-Type-Options: nosniff, but the X-XSS-Protection header has the value 1; mode=block and the three other headers aren't present at all.

What am I doing wrong, and how do I do it correctly?

Jorn
  • 501
  • 1
  • 4
  • 14

0 Answers0