nginx - Security headers within location block?

Question

I have been testing the security headers (https://securityheaders.com) of my nginx setup and wanted to check peoples opinion with nginx suffix location blocks.

Currently, I get 'A+' for http(s)://my.site however, 'B' when testing a suffix location ie https://my.site/location1

The warnings are for missing:-

Content-Security-Policy
Referrer-Policy
Feature-Policy

My server block which receives 'A+' consists of:-

    add_header 'Referrer-Policy' 'no-referrer';
    add_header Strict-Transport-Security "max-age=15552000; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;;speaker self;vibrate none;fullscreen self;payment none;";
    add_header Content-Security-Policy "frame-ancestors my.site;";

an example location block that receives 'B' consists of:-

location /location1 {
    proxy_pass              http://192.168.1.1;
    proxy_set_header        X-Real-IP         $remote_addr;
    proxy_set_header        Host              $host;
    proxy_set_header        X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_redirect          off;
    proxy_buffering         off;
    auth_basic              "Restricted";
    auth_basic_user_file    /etc/nginx/.htpasswd;
    error_log               /var/log/nginx/blah.error.log;

I have played around with adding the CSP within the location block, however if ths is the way - I must be getting the syntax wrong.

Are the security headers intended to cascade into location blocks? Or is the result of the scan expected? Or am I just noobing...

Cheers, Jonny

Is that the entire location block? – womble May 02 '19 at 07:31 — womble, May 02 '19 at 07:31
Hi womble, yes it is. Just left out the final } – jonny21 May 02 '19 at 09:19 — jonny21, May 02 '19 at 09:19

score 2 · Accepted Answer · answered May 02 '19 at 10:31

2

The headers that are reported as being missing are lacking an always directive. I'm guessing that whatever is being tested against isn't returning one of the response codes that add_header wants in order to return the other headers.

answered May 02 '19 at 10:31

womble

96,255
29
175
230

This was it mate, legend. I added `always;` to each of those complaining headers. Thanks again, Jonny – jonny21 May 02 '19 at 22:36

nginx - Security headers within location block?

1 Answers1