From a36b8557150919075d5245e29739173c3830d5ae Mon Sep 17 00:00:00 2001 From: Christian Anguiano Date: Tue, 23 Apr 2019 13:57:03 -0700 Subject: [PATCH] Enable HTTP Strict Transport Security. This is added for security purposes and in order to suppress the "The "Strict-Transport-Security" HTTP header is not set to at least "15552000" seconds." warning in Nextcloud's security scan. --- nextcloud.subdomain.conf.sample | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nextcloud.subdomain.conf.sample b/nextcloud.subdomain.conf.sample index 6ff353d..2859ad2 100644 --- a/nextcloud.subdomain.conf.sample +++ b/nextcloud.subdomain.conf.sample @@ -21,7 +21,9 @@ server { include /config/nginx/ssl.conf; client_max_body_size 0; - + + add_header Strict-Transport-Security "max-age=15552000; includeSubDomains"; + location / { include /config/nginx/proxy.conf; resolver 127.0.0.11 valid=30s;