add csp headers to bitrix

paskal · Jan 5, 2024 · e7b3ae9 · e7b3ae9
1 parent 3c4544c
commit e7b3ae9
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 12 deletions.
diff --git a/config/nginx/Dockerfile b/config/nginx/Dockerfile
@@ -11,15 +11,10 @@ RUN echo http://dl-2.alpinelinux.org/alpine/edge/community/ >> /etc/apk/reposito
 
 # shadow for usermod
 # brotli for compression
-# set-misc for nonce random string generation
-RUN apk add --no-cache nginx-mod-http-brotli nginx-mod-http-set-misc shadow
+RUN apk add --no-cache nginx-mod-http-brotli shadow
 
 RUN usermod -u 1000 nginx
 RUN groupmod -g 1000 nginx
 
-# prepare to switching to non-root - update file permissions of directory containing
-# nginx.lock and nginx.pid file
-RUN chown -R --verbose nginx:nginx /var/run/nginx/ /var/cache/nginx/
-
 # run nginx with configuration reload once in every 6 hours
 CMD /bin/sh -c 'while :; do /bin/sleep 6h & wait ${!}; /usr/sbin/nginx -s reload; done & /usr/sbin/nginx -g "daemon off;"'
diff --git a/config/nginx/conf.d/adminer.conf b/config/nginx/conf.d/adminer.conf
@@ -1,8 +1,8 @@
 server {
     listen 443 http2 ssl;
-	ssl_certificate      /etc/nginx/letsencrypt/live/favor-group.ru/fullchain.pem;
-	ssl_certificate_key  /etc/nginx/letsencrypt/live/favor-group.ru/privkey.pem;
-	ssl_trusted_certificate /etc/nginx/letsencrypt/live/favor-group.ru/chain.pem;
+    ssl_certificate      /etc/nginx/letsencrypt/live/favor-group.ru/fullchain.pem;
+    ssl_certificate_key  /etc/nginx/letsencrypt/live/favor-group.ru/privkey.pem;
+    ssl_trusted_certificate /etc/nginx/letsencrypt/live/favor-group.ru/chain.pem;
 
     server_name  adminer.favor-group.ru;
     # Dmitry Verkhoturov and Eugene Donich external address

diff --git a/config/nginx/conf.d/dev-test.conf b/config/nginx/conf.d/dev-test.conf
@@ -1,5 +1,5 @@
 server {
-    listen  443 http2 ssl;
+    listen 443 http2 ssl;
 
     server_name dev-test.favor-group.ru;
 

diff --git a/config/nginx/conf.d/dev.conf b/config/nginx/conf.d/dev.conf
@@ -1,5 +1,5 @@
 server {
-    listen  443 http2 ssl;
+    listen 443 http2 ssl;
 
     server_name dev.favor-group.ru;
 

diff --git a/config/nginx/nginx.conf b/config/nginx/nginx.conf
@@ -70,7 +70,6 @@ http {
     map_hash_bucket_size            512;
     # increase concurrency performance
     keepalive_requests              1000;
-    http2                           on;
     # 0-RTT QUIC connection resumption
     ssl_early_data                  on;
 

diff --git a/config/nginx/security_headers.conf b/config/nginx/security_headers.conf
@@ -15,3 +15,6 @@ add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains; prelo
 
 # for the sake of better benchmark score
 add_header Referrer-Policy same-origin;
+
+# CSP header
+add_header Content-Security-Policy "default-src 'self' https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://fonts.bitrix24.ru/ https://fs-group.bitrix24.ru 'unsafe-inline'; connect-src 'self' https://api.clickfraud.dev https://mc.yandex.com https://mc.yandex.ru https://*.google.com https://*.google.ru https://stats.g.doubleclick.net https://*.clickfraud.ru; font-src data: https://fonts.bitrix24.ru https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru; frame-src https://mc.yandex.ru https://yandex.ru https://www.google.com; img-src 'self' data: https://*.yandex.com https://*.yandex.ru https://*.yandex.net https://www.googletagmanager.com https://*.google.ru https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://counter.yadro.ru; script-src 'self' https://static.cdn-favor-group.ru https://dev.cdn-favor-group.ru https://widgets.mango-office.ru/ https://dct.mango-office.ru https://www.googletagmanager.com https://cdn-ru.bitrix24.ru/ https://*.clickfraud.ru https://www.google.com https://*.yandex.ru https://*.yandex.net https://fs-group.bitrix24.ru https://cdn.jsdelivr.net https://www.gstatic.com https://cdnjs.cloudflare.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'" always;